Attack Surface Offensive Security Analyst

EY; Richmond (VA); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Flexible vacation policy

Total Rewards package

Job summary

EY is seeking an Offensive Security Analyst to assess EY’s external and internal attack surface through hands-on penetration testing and adversarial simulation. You will identify vulnerabilities across web applications, APIs, cloud environments, networks, and infrastructure, and help prioritize remediation with stakeholders.

Join EY’s global security team to strengthen proactive defense and reduce risk while working in a hybrid model with flexible time off and comprehensive Total Rewards.

Qualifications

• 4+ years of experience in penetration testing, red teaming, purple teaming or offensive security
• Hands-on experience testing applications, APIs, cloud environments, and network infrastructure
• Strong understanding of common vulnerability classes such as OWASP Top 10 and exploitation techniques
• Familiarity with offensive security methodologies and frameworks
• Experience supporting or performing third-party risk assessments
• Strong analytical and problem-solving skills with the ability to prioritize risks effectively
• Strong communication and stakeholder management skills

Responsibilities

• Identify vulnerabilities across EY’s external and internal attack surface, including web apps, APIs, cloud environments, networks, and infrastructure
• Emulate adversary tactics to test detection and response capabilities and validate exploitability
• Perform reconnaissance and asset discovery to uncover unmanaged or exposed assets
• Support third-party risk validation efforts and conduct targeted testing as needed
• Collaborate with security engineering, blue teams, and business stakeholders to prioritize remediation
• Help enhance processes, playbooks, and reporting standards within Vulnerability Discovery and offensive security functions

Skills

Offensive security

Penetration testing

Threat modeling

Adversarial simulation

Cloud & API testing

Strong communication

Risk evaluation

Tools

Qualys

Nessus

Job description

EY is seeking an Offensive Security Analyst to assess EY’s external and internal attack surface through hands-on penetration testing and adversarial simulation. You will identify vulnerabilities across web applications, APIs, cloud environments, networks, and infrastructure, and help prioritize remediation with stakeholders.

Join EY’s global security team to strengthen proactive defense and reduce risk while working in a hybrid model with flexible time off and comprehensive Total Rewards.