, including but not limited to cyber, physical, supply chain, operational, and geopolitical disruptions. This role goes... spanning multiple hazard types (cyber, physical, supply chain, etc.) Define escalation models from business-unit incidents...
with attack frameworks (MITRE ATT&CK) and mitigation strategies. Strong analytical and problem-solving skills. Excellent... for CI/CD security, supply-chain controls, infrastructure-as-code guardrails, product application security, product pentesting...
assessments Experience with software supply chain security concepts, including SBOMs, dependency management, code signing... frameworks such as OWASP SAMM, BSIMM, NIST SSDF, NIST CSF, NIST AI RMF, ISO 27001, ISO/IEC 42001, IEC 62443, and MITRE ATT&CK...
STIG-based hardening where applicable) Lead system-level threat modeling (e.g., STRIDE / MITRE ATT&CK for ICS... experience will be considered Familiarity with SBOM concepts and supply chain security considerations for medical devices...
. Assess AI-specific risks including data handling, model provenance, supply chain integrity, API security, third-party model... augmented generation (RAG) poisoning, model supply chain risks, agentic AI risks, and AI misuse scenario Experience with ML...
, prompt injection, jailbreaks, model extraction and inversion, membership inference, data and supply-chain poisoning, evasion..., and testing endpoints protected by modern EDR/XDR. Purple-team and adversary-emulation fluency: MITRE ATT&CK, and platforms...
applications, prompt injection, jailbreaks, model extraction and inversion, membership inference, data and supply-chain poisoning.../XDR. Purple-team and adversary-emulation fluency: MITRE ATT&CK, and platforms such as VECTR or Atomic Red Team. Hands...
applications, prompt injection, jailbreaks, model extraction and inversion, membership inference, data and supply-chain poisoning... ATT&CK, and platforms such as VECTR or Atomic Red Team. Hands-on with AI red-teaming frameworks such as PyRIT or Garak...
(STRIDE, PASTA, LINDDUN, MITRE ATT&CK) into automation, and make pentest scoping decisions defensible and repeatable. Set the... injection, and agent-misuse risk. DevSecOps, IaC security, or supply-chain depth, and senior-relevant certifications (e.g...
triage to determine attacker TTPs Perform kill chain reconstruction — map attacker activity to MITRE ATT&CK, identify... queries that map to MITRE ATT&CK coverage gaps AIDR (AI Detection & Response) Configure and tune AI-driven detection...