Security Analyst, Attack Surface Management

Uvcyber

Hyderabad, India

On-site

Who this role is best for

Strong fit for candidates with vulnerability management and penetration testing expertise who can independently assess and communicate risk.

Best fit for

Candidates with 2+ years in application security and a track record in bug bounty programs
— “Two or more years in application security, vulnerability management, penetration testing, or bug bounty work.”
Individuals skilled in OWASP Top 10 and API Security with practical remediation knowledge
— “Practical knowledge of OWASP Top 10 and OWASP API Security Top 10, including what remediation actually looks like for each class of issue.”
Professionals adept at connecting findings to MITRE ATT&CK techniques and attacker behavior
— “Familiarity with MITRE ATT&CK techniques and the ability to connect a finding to how an attacker would chain it.”

Things to consider

The role demands high attention to detail in severity assessments and risk communication
— “Independently assess impact rather than accepting a submitter's or a scanner's rating.”
Candidates must be prepared to engage directly with engineering teams on remediation timelines
— “Partner with application owners and product teams on remediation timelines.”

How to stand out

Demonstrate experience in validating findings and writing actionable remediation guidance
— “Write remediation guidance that an application or platform engineer can act on without further translation.”
Highlight ability to reproduce findings and determine severity beyond CVSS scores
— “Severity determination beyond a CVSS calculator.”
Showcase practical experience with Burp Suite and API testing tools in your resume or interview
— “Hands-on experience with Burp Suite and standard web and API testing tooling.”

Pace · SteadyCollaboration · MediumAutonomy · MediumDecision Impact · Team

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

validating findings
driving remediation
escalating critical issues

Typical background

application securityvulnerability management

Skills & requirements

Required

Vulnerability ManagementPenetration TestingAttack Surface ManagementBug Bounty

Preferred

Cloud SecurityScripting

Stack & domain

Application SecurityVulnerability ManagementPenetration TestingBug Bounty WorkOwasp Top 10Mitre Att&ck TechniquesBurp SuiteCommunicationProblem-solvingDecision-makingBSCPOSWAOSCPCPTSPNPTWeb Application SecurityAPI SecurityCloud Security

About the role

Original posting from Uvcyber via Lever

Job Title: Security Analyst, Attack Surface Management
Summary
The Attack Surface Management team owns what happens after a vulnerability is found. Findings arrive from red team pentests, adversary simulations, external bug bounty submissions, and scanning coverage. This role validates them, determines real impact, and drives them to closure with the engineering teams that own the affected assets. Critical findings route to Incident Response. Everything rated High and Medium is this team's responsibility until it is patched or a compensating control is in place and documented.
This is not a patch operations role. Separate teams apply fixes. This role decides what matters, why it matters, and holds the line until it is resolved.
Responsibilities
Triage and validate inbound Bugcrowd submissions: reproduce the reported issue, confirm or reject it, deduplicate against known findings, and determine payout-relevant severity.
Independently assess impact rather than accepting a submitter's or a scanner's rating. Factor in exploitability, asset exposure, data sensitivity, authentication requirements, and existing controls.
Track High and Medium findings from red team engagements and adversary simulations through remediation, including retest and closure verification.
Evaluate and document compensating controls where a fix is not immediately viable, and set expiry conditions rather than leaving exceptions open indefinitely.
Write remediation guidance that an application or platform engineer can act on without further translation.
Escalate Critical findings to Incident Response with the reproduction detail and blast radius assessment they need to act.
Partner with application owners and product teams on remediation timelines, and raise risk acceptance decisions to leadership when timelines slip.
Maintain visibility into externally exposed assets and flag newly surfaced attack surface for assessment.
Required Qualifications
Two or more years in application security, vulnerability management, penetration testing, or bug bounty work.
Working proficiency in web application and API penetration testing. You should be able to independently reproduce a submitted finding, escalate it if the submitter undersold it, and prove it is a false positive if it is one.
Practical knowledge of OWASP Top 10 and OWASP API Security Top 10, including what remediation actually looks like for each class of issue.
Familiarity with MITRE ATT&CK techniques and the ability to connect a finding to how an attacker would chain it.
Severity determination beyond a CVSS calculator. You can explain why a High-scoring finding on an isolated internal asset may matter less than a Medium on an internet-facing authentication flow.
Hands-on experience with Burp Suite and standard web and API testing tooling.
Clear written communication. Much of this role is convincing an engineering team that a finding is real and worth their sprint capacity.
Preferred Qualifications
Demonstrated bug bounty track record on Bugcrowd, HackerOne, or Intigriti.
Experience triaging submissions from the program side.
Cloud security exposure across AWS or Azure, particularly identity and storage misconfigurations.
Certifications such as BSCP, OSWA, OSCP, CPTS, or PNPT. A public bug bounty profile carries equal weight.
Scripting in Python for reproduction harnesses and finding automation.

Source: Uvcyber careers (Lever)