Attack Surface Offensive Security Analyst

EY; Olympia (WA); Hybrid; USD 76,000 - 139,000; Full time

Job summary

EY in the United States is seeking an Offensive Security Analyst to evaluate EY's external and internal attack surface through hands-on penetration testing and adversarial simulation. Working under the Exposure Management Lead, you will identify vulnerabilities and help reduce risk across EY’s global technology landscape.

You will test web apps, APIs, cloud environments, and networks, emulate adversary tactics to validate detection and response, and contribute to strengthening threat exposure

Qualifications

• 4+ years in penetration testing, red/purple team or offensive security.
• Hands-on testing of applications, APIs, cloud environments, and network infrastructure.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting or performing third‑party risk assessments.
• Strong analytical and problem‑solving skills with the ability to prioritize risks effectively.
• Strong communication and stakeholder management skills.

Responsibilities

• Assess EY’s external and internal attack surface for vulnerabilities across web apps, APIs, cloud, networks, and infrastructure.
• Test proof-of-concepts to validate exploitability and real-world impact.
• Emulate adversary tactics to test detection and response capabilities.
• Support third-party risk assessments and targeted testing as required.
• Collaborate with security engineering, blue teams, and business stakeholders to prioritize remediation by risk severity.
• Contribute to enhancing processes, playbooks, and reporting standards within Vulnerability Discovery and offensive security functions.

Skills

Vulnerability exploitation

Attention to detail

Critical thinking

Testing workload

Cloud & infra

Communication

Threat intel

Tools

Qualys

Nessus

Job description

EY in the United States is seeking an Offensive Security Analyst to evaluate EY's external and internal attack surface through hands-on penetration testing and adversarial simulation. Working under the Exposure Management Lead, you will identify vulnerabilities and help reduce risk across EY’s global technology landscape.

You will test web apps, APIs, cloud environments, and networks, emulate adversary tactics to validate detection and response, and contribute to strengthening threat exposure