Attack Surface Offensive Security Analyst

EY; Salem (OR); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Comprehensive benefits package

Paid time off

401(k)

Job summary

EY is seeking an Offensive Security Analyst to join the Attack Surface Management team. You will perform hands-on penetration testing, adversarial simulations, and vulnerability evaluation across EY’s global surface, improving proactive defense and reducing business risk.

You’ll emulate threat actors, test detection and response, and collaborate with security engineering, blue teams, and stakeholders to prioritize remediation. EY offers a hybrid work model and a comprehensive benefits package.

Qualifications

• Minimum 4 years of experience in penetration testing, red teaming, purple teaming or offensive security.
• Hands-on testing experience across applications, APIs, cloud environments, and networks.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting third-party risk assessments.
• Strong analytical and stakeholder communication skills.

Responsibilities

• Assess EY's external and internal attack surface across web apps, APIs, cloud, networks and infrastructure.
• Emulate adversary tactics to test detection and response capabilities.
• Identify vulnerabilities and prioritize remediation based on risk and exploitability.
• Contribute to Threat Exposure Management and reporting standards within offensive security.

Skills

Penetration testing

Red teaming

Offensive security

APIs testing

Cloud security

Vulnerability assessment

Communication

Job description

EY is seeking an Offensive Security Analyst to join the Attack Surface Management team. You will perform hands-on penetration testing, adversarial simulations, and vulnerability evaluation across EY’s global surface, improving proactive defense and reducing business risk.

You’ll emulate threat actors, test detection and response, and collaborate with security engineering, blue teams, and stakeholders to prioritize remediation. EY offers a hybrid work model and a comprehensive benefits package.