Senior Penetration Testing Consultant

EY GDS; Philippines; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

EY GDS is seeking a Senior Penetration Tester to join its Cybersecurity team in the Philippines. You will perform hands-on penetration testing across web apps, networks, AD, wireless, and cloud environments, producing detailed reports and remediation guidance.

You’ll independently conduct complex security assessments, lead junior colleagues, and contribute to Red Team activities and security testing programs aligned with OWASP Top 10 and Secure SDLC practices.

Qualifications

• Bachelor’s degree in CS/IT/Engineering or equivalent.
• Minimum of 6 years of relevant penetration testing/offensive security experience.
• Hands-on testing across web apps, networks, Active Directory, cloud environments, and OT/IoT where applicable.
• OSCP/OSCE/OSEP/OSWE or CREST/eCPPT/eWPTX or similar certifications.
• Ability to mentor junior team members and clearly communicate findings.

Responsibilities

• Perform penetration testing across internet-facing and internal networks, web applications, wireless environments, and enterprise infrastructure.
• Execute Red Team and adversary simulation assessments to identify weaknesses in an organization’s security posture.
• Identify and exploit vulnerabilities across applications, networks, operating systems, and infrastructure.
• Perform Active Directory security assessments and attack simulations.
• Conduct in-depth analysis of penetration testing results and validate exploitability and business impact.
• Create comprehensive technical reports covering findings, exploitation procedures, risks, and remediation recommendations.
• Communicate complex security findings to technical teams, business stakeholders, and executive audiences.
• Perform security testing based on OWASP Top 10 and established penetration testing methodologies.
• Support application security testing, including DAST, SAST, source code review, and Secure SDLC activities.
• Develop automation to improve penetration testing, security testing, and reporting processes.
• Support security assessments involving AWS, Microsoft Azure, GCP, OT, and IoT environments where applicable.
• Provide technical guidance and mentoring to junior team members on penetration testing engagements.

Skills

Penetration testing

Offensive security

OWASP Top 10

Active Directory

Cloud security (AWS/Azure/GCP)

Network security

Windows OS

Linux/Unix

Education

Bachelor’s degree in Computer Science, Information Technology, Engineering

Job description

Senior Penetration Tester | Cybersecurity

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture, and technology to become the best version of yourself. We’re counting on your unique voice and perspective to help EY become even better. Join us and build an exceptional experience for yourself and a better working world for all.

The Opportunity

As part of EY’s Cybersecurity team, you will perform hands-on penetration testing and security assessments across a variety of environments, including web applications, networks, Active Directory, wireless environments, cloud platforms, and other enterprise technologies.

You will identify and exploit security vulnerabilities, analyze their potential impact, and develop detailed reports covering findings, exploitation techniques, associated risks, and recommended remediation.

We’re looking for an experienced Penetration Tester / Offensive Security professional who can independently execute complex security assessments while also providing technical guidance to junior team members.

Your Key Responsibilities

• Perform penetration testing across internet-facing and internal networks, web applications, wireless environments, and enterprise infrastructure.

• Execute Red Team and adversary simulation assessments to identify weaknesses in an organization’s security posture.

• Identify and exploit vulnerabilities across applications, networks, operating systems, and infrastructure.

• Perform Active Directory security assessments and attack simulations.

• Conduct in-depth analysis of penetration testing results and validate the exploitability and business impact of identified vulnerabilities.

• Create comprehensive technical reports covering findings, exploitation procedures, risks, and remediation recommendations.

• Communicate complex security findings to technical teams, business stakeholders, and executive audiences.

• Perform security testing based on OWASP Top 10 and established penetration testing methodologies.

• Support application security testing, including DAST, SAST, source code review, and Secure SDLC activities.

• Develop automation to improve penetration testing, security testing, and reporting processes.

• Support security assessments involving AWS, Microsoft Azure, GCP, Operational Technology (OT), and IoT environments, where applicable.

• Provide technical guidance and mentoring to junior team members on penetration testing engagements.

Skills and Attributes for Success

• Strong hands-on experience in penetration testing and offensive security.

• Strong understanding of OWASP Top 10 and common web application vulnerabilities.

• Experience assessing Active Directory and Windows environments.

• Strong understanding of TCP/IP, network security, and common attack vectors.

• Experience with internal and external network penetration testing.

• Knowledge of Windows, Linux, UNIX, and other major operating systems.

• Exposure to cloud penetration testing across AWS, Azure, or GCP.

• Exposure to OT/IoT and wireless penetration testing is an advantage.

• Understanding of application security testing and SAST/DAST.

• Ability to clearly communicate technical security findings to both technical and non-technical stakeholders.

• Strong technical writing skills, particularly for penetration testing reports and remediation recommendations.

To Qualify for the Role

• Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related discipline, or equivalent relevant experience.

• Minimum of 6 years of relevant penetration testing / offensive security experience.

• Hands-on experience across multiple penetration testing areas, such as:

  • Web applications

  • Internal and external networks

  • Active Directory

  • Wireless environments

  • Red Team assessments

  • Cloud environments

• At least one relevant certification such as:

  • OSCP

  • OSCE

  • OSEP

  • OSWE

  • CREST

  • CRTE

  • eCPPT/eCPTX

  • eWPTX

Ideally, You’ll Also Have

• CISSP, GPEN, or GWAPT certification.

• Red Team or adversary simulation experience.

• Experience with security automation and scripting.

• Project or engagement management experience.

• Experience working directly with clients and communicating findings to senior stakeholders.

What We Look For

We’re looking for someone who can go beyond automated vulnerability scanning and perform hands-on exploitation and penetration testing.

The ideal candidate can independently assess applications, networks, Active Directory, and other enterprise environments, demonstrate the real-world impact of identified vulnerabilities, and clearly communicate remediation recommendations to clients and technical teams.