Senior Security Engineer Attack Surface Platforms (Remote) at First American

Job description

Who We Are Join a team that puts its People First! Since 1889, First American (NYSE: FAF) has held an unwavering belief in its people. They are passionate about what they do, and we are equally passionate about fostering an environment where all feel welcome, supported, and empowered to be innovative and reach their full potential. Our inclusive, people-first culture has earned our company numerous accolades, including being named to the Fortune 100 Best Companies to Work For® list for eleven consecutive years. We have also earned awards as a best place to work for women, diversity and LGBTQ+ employees, and have been included on more than 50 regional best places to work lists. First American will always strive to be a great place to work, for all. For more information, please visit www.careers.firstam.com. What We Do The Senior Security Engineer – Attack Surface Platforms serves as the subject matter expert for the organization’s external attack surface management (EASM) capability. This role leads platform operations, asset discovery coverage, exposure analysis, and remediation workflows for internet-facing assets. The engineer works across security and technology teams to validate findings, direct risk reduction, improve platform quality, and develop repeatable processes and targeted enhancements. Essential Functions · Serve as the technical subject matter expert for our EASM platform. Administer platform configuration, access, integrations, workflows, reporting, and operational health. · Maintain reliable discovery and inventory of internet-facing assets, including domains, IP addresses, hosts, and services. Review coverage, data quality, changes, and newly observed assets to identify potential gaps or unmanaged exposure. · Validate asset attribution and ownership by correlating EASM findings with available business, cloud, network, DNS, and inventory context. Identify unknown or potentially unauthorized assets and route them for investigation. · Analyze external exposures such as vulnerable technologies, misconfigurations, exposed services, and assets that do not meet security standards. Prioritize response using exposure context, exploitability, business importance, and available threat information. · Lead remediation coordination with cloud, network, infrastructure, application, and business teams. Clarify the risk and recommended action, track progress, verify closure, and escalate urgent or overdue exposures through established processes. · Tune platform policies, risk settings, alerting, and exception workflows to improve signal quality and reduce duplicate or non-actionable findings. Document the rationale for material changes and validate results after implementation. · Build and maintain integrations between the EASM platform and relevant asset inventory, ticketing, cloud security, or security operations systems. Troubleshoot data flow, mapping, ownership, and workflow issues with platform administrators and vendors. · Develop targeted automation and platform enhancements using available APIs, scripts, dashboards, and workflow features to improve asset review, triage, reporting, and remediation tracking. · Produce operational and management reporting on asset coverage, newly discovered assets, exposure trends, remediation status, recurring issues, and platform health. Explain data limitations and highlight items that require action. · Lead EASM onboarding and change reviews for new domains, business units, cloud environments, brands, and acquisitions. Ensure discovery and ownership processes are updated as the organization changes. · Support security investigations and incident response when an externally exposed asset or service may contribute to risk. Preserve relevant platform evidence and coordinate follow-up actions with response teams. · Develop runbooks and standards for EASM operations. Guide platform users and partner teams on finding validation, ownership, prioritization, and effective remediation. Workin