Information Security Analyst - Exposure Management

The Security Operations & Engineering team at MathWorks is responsible for securing the cloud environments and internal infrastructure that power our global products and platforms. We partner across engineering, IT, and international teams to detect threats, respond to incidents, and continuously harden our security posture.

Responsibilities

• Conduct continuous discovery and assessment of internal and external attack surfaces to identify security exposures and potential attack paths
• Respond to alerting from security tools, with a focus on cloud and on-prem vulnerabilities
• Proactively monitor and create alerting rules for vulnerabilities and threats
• Ensure alignment of physical and cloud resources with approved security baselines, policies, and guardrails
• Perform threat hunting on IOCs associated with emerging threats
• Stay current on emerging threats through blogs, vendor advisories, and threat intelligence feeds
• Perform security posture monitoring through Microsoft Secure Score and similar signals across security tooling
• Monitor and resolve gaps in internal attack surface coverage using asset management tools 
• Experience identifying, assessing, and prioritizing security exposures across internal and external environments

Minimum Qualifications

• A bachelor's degree and 6 years of professional work experience (or a master's degree and 3 years of professional work experience, or a PhD degree, or equivalent experience) is required.

Additional Qualifications

• Experience in security operations or engineering 
• Experience in Exposure Management, Attack Surface Management (ASM)
• Certifications in cybersecurity are a plus (CompTIA Security+, GCIH, GCIA, or equivalent)
• Experience with SIEM, CSPM, or CNAPP platforms
• Knowledge of risk-based vulnerability management methodologies and security frameworks such as NIST CSF, CIS Controls, ISO 27001, or MITRE ATT&CK.
• Hands-on experience with threat detection, alert triage, and incident response
• Experience with risk-based prioritization of security exposures by considering threat intelligence, exploitability, business criticality, and asset context.