Attack Surface Penetration Analyst

EY; Annapolis (MD); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Competitive compensation

Paid time off

Job summary

EY is seeking an Offensive Security Analyst to evaluate and reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will identify, assess and mitigate vulnerabilities across EY’s global attack surface, emulating threat actors and validating exploitability while supporting proactive risk reduction.

You will collaborate with security engineering and business stakeholders to prioritize remediation and strengthen continuous threat exposure management.

Qualifications

• 4+ years of experience in penetration testing, red teaming, purple teaming or offensive security.
• Hands-on experience testing applications, APIs, cloud environments and network infrastructure.
• Strong understanding of common vulnerability classes such as OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting or performing third-party risk assessments.
• Strong analytical and problem-solving skills with the ability to prioritize risks effectively.
• Strong communication and stakeholder management skills.

Responsibilities

• Assess EY’s external and internal attack surface by identifying vulnerabilities across web apps, APIs, cloud, networks and infrastructure.
• Emulate adversary tactics to test detection and response capabilities and validate exploitability.
• Conduct reconnaissance and asset discovery to uncover unmanaged or exposed assets.
• Review third-party risk assessments or conduct targeted testing to support supplier risk validation.
• Collaborate with security engineering, blue teams and business stakeholders to prioritize remediation by risk and exploitability.
• Help enhance processes, playbooks and reporting standards within Vulnerability Discovery and offensive security functions.

Skills

Penetration testing

Red teaming

Purple teaming

Offensive security

Threat intelligence

Job description

EY is seeking an Offensive Security Analyst to evaluate and reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will identify, assess and mitigate vulnerabilities across EY’s global attack surface, emulating threat actors and validating exploitability while supporting proactive risk reduction.

You will collaborate with security engineering and business stakeholders to prioritize remediation and strengthen continuous threat exposure management.