Attack Surface Penetration & Adversary Simulation Analyst

EY; Columbus (OH); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Medical and dental coverage

Paid time off

Job summary

EY is seeking an Offensive Security Analyst to evaluate and reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will identify, assess, and mitigate vulnerabilities across EY’s global attack surface under guidance, emulating threat actors and testing detection and response capabilities.

Join EY’s Information Security team to strengthen threat exposure management, support third-party risk assessments, and help prioritize remediation based on risk and

Qualifications

• 4+ years of experience in penetration testing, red teaming, purple teaming or offensive security.
• Hands-on experience testing applications, APIs, cloud environments and network infrastructure.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting or performing third‑party risk assessments.
• Strong analytical and problem‑solving skills with risk prioritization.
• Strong communication and stakeholder management skills.

Responsibilities

• Assess EY’s external and internal attack surface, identifying vulnerabilities across web apps, APIs, cloud, networks, and infrastructure.
• Emulate adversary tactics to test detection and response capabilities and validate exploitability.
• Collaborate with security engineering, blue teams and business stakeholders to prioritize remediation by risk severity.
• Contribute to playbooks, reporting standards, and vulnerability discovery processes within offensive security.

Skills

Penetration testing

Red teaming

Purple teaming

Offensive security methodologies

Threat intelligence

Adversary simulation

Tools

Qualys

Nessus

Job description

EY is seeking an Offensive Security Analyst to evaluate and reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will identify, assess, and mitigate vulnerabilities across EY’s global attack surface under guidance, emulating threat actors and testing detection and response capabilities.

Join EY’s Information Security team to strengthen threat exposure management, support third-party risk assessments, and help prioritize remediation based on risk and