Exposure Management SME

In this role, you will lead the development and operationalization of the organization's Continuous Threat Exposure Management (CTEM) and cloud exposure management capabilities.

You will help move vulnerability management beyond traditional severity-based approaches by introducing attack-path analysis, business-context prioritization, and measurable risk reduction practices. Your focus will be identifying the exposures that matter most, validating their real-world impact, and ensuring they are effectively remediated.

You will work closely with cloud security, engineering, governance, and platform teams to build a modern exposure management program across AWS and GCP environments.

Responsibilities

• Design and implement the CTEM and risk-based vulnerability management program, including recommending the framework it follows.
• Define the prioritization methodology that combines vulnerabilities, misconfigurations, identity exposures, and business context.
• Analyze cloud attack paths and chains to identify and validate the highest-risk exposure scenarios.
• Define remediation SLAs and separate workflows for backlog, new, and emergency findings, aligned with GRC exception and risk acceptance processes.
• Build executive reporting focused on risk reduction and exposure metrics.

Requirements

• 5+ years of experience in cloud security, vulnerability management, exposure management, or offensive security.
• Strong understanding of CTEM principles and risk-based security programs.
• Experience with CNAPP solutions (preferably Upwind or Wiz).
• Experience performing attack-path analysis and exposure validation.
• Strong knowledge of AWS and GCP security architecture.
• Understanding of IAM security, privilege escalation paths, and identity exposure risks.
• Experience building or operating vulnerability management programs.
• Experience collaborating with engineering and platform teams to drive remediation.
• Strong analytical and stakeholder communication skills.
• Very good English level (B2+-C1)
• Exposure management, attack surface management, or security operations experience would be a plus.
• Offensive security or penetration testing background would be nice to have
• Experience with cloud AI environments and AI infrastructure security is considered a plus
• Experience with security telemetry and detection engineering are nice to have
• One or more industry-recognized security certifications, such as AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, CISSP, CCSK, CCSP, or equivalent are an advantage.
• Familiarity with MITRE ATT&CK and MITRE ATLAS considered as an advantage

SoftServe is an equal opportunity employer. Qualified applicants will receive consideration regardless of race, color, ancestry, ethnicity, national origin, religion, sex, sexual orientation, gender identity or expression, age, citizenship, disability, health condition, marital or family status, veteran status, or any other characteristic protected by applicable law.

About us

We are a digital engineering and technology consulting company where expertise grows alongsidepeople. For more than 30years, we have been elevating technology: helping organizations navigate complex businesschallenges by combining deepengineering knowledge with thoughtful, research-backed innovation. Our teams work across keyareas: digitalengineering, data and analytics, Сloud, and AI/ML. In each, we deliver practical, scalablesolutions rooted in realbusiness needs and measurable human impact.

You bring your perspective and ambition. We create an environment where your work meetsclarity, confidence, andpurpose.

We offer

Work from home, from the office, or in a hybrid format that supports focus andcollaboration.

Competitive, market-based pay, benchmarked by role andlocation — plus health coverage, paid time off, wellness support, and learningopportunities.

Approachable leaders who communicate openly, keep teams close to the strategy, andsupport long-term planning.

Advanced tech communities

Stay close to AI/ML, Cloud, Quantum Computing, IoT, andRobotics communities, with projects built on modern frameworks.

More opportunities available

Browse all open positions to find the best fit for your experience.