Senior Attack Surface & Exposure Engineer

EY; Katowice; Hybrid; PLN 270,000 - 450,000; Full time

Job summary

EY GDS Poland is seeking a senior Attack Surface Validation & Exposure Engineer to join the security team in a hybrid capacity (Wrocław/Katowice). You will lead automated attack-path discovery, build scalable detection pipelines, and develop controlled exploitation workflows to demonstrate real attacker outcomes.

You will partner with Red Team, Exposure Assessment, Threat Detection, and VM stakeholders to identify critical exposures and drive remediation with evidence-based narratives.

Qualifications

• Minimum combined 8 years of experience in vulnerability management, exposure management, offensive security, and security engineering
• Demonstrated experience analyzing vulnerability and security posture data
• Strong analytical skills with the ability to evaluate large volumes of data to influence solution development
• Excellent communication skills, with comfort engaging senior stakeholders and security leadership
• Ability to manage competing priorities and operate independently in a complex, global environment

Responsibilities

• Design and engineer automated attack-path discovery and validation capabilities
• Build scalable vulnerability detection and verification pipelines that combine enterprise scanning sources with custom validation logic
• Develop controlled exploitation and exploit-chaining workflows to safely demonstrate real attacker outcomes
• Operationalize continuous offensive validation by engineering testing routines that can run with minimal human prompting
• Fuse Vulnerability Intelligence and Cyber Threat Intelligence into detection and prioritization—tracking exploit maturity/availability, active exploitation signals, and technique trends
• Produce high-fidelity deliverables that enable remediation and decisioning
• Partner across Red Team, Exposure Assessment, Threat Detection, and VM stakeholders

Job description

EY GDS Poland is seeking a senior Attack Surface Validation & Exposure Engineer to join the security team in a hybrid capacity (Wrocław/Katowice). You will lead automated attack-path discovery, build scalable detection pipelines, and develop controlled exploitation workflows to demonstrate real attacker outcomes.

You will partner with Red Team, Exposure Assessment, Threat Detection, and VM stakeholders to identify critical exposures and drive remediation with evidence-based narratives.