Attack Surface Penetration Analyst

Ernst and Young; Little Rock (AR); Hybrid; USD 76,000 - 139,000; Full time

Job summary

EY is seeking an Offensive Security Analyst to evaluate and reduce EY's digital exposure through hands-on penetration testing and adversarial simulation. You will identify, assess and help mitigate vulnerabilities across EY’s global attack surface, emulating threat actors and validating exploitability while supporting third‑party risk assessments.

Join a team that strengthens Continuous Threat Exposure Management and Attack Surface Management, delivering actionable insights to improve proactive

Qualifications

• 4+ years in penetration testing, red/purple teaming or offensive security.
• Experience testing applications, APIs, cloud environments and networks.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting third‑party risk assessments.
• Strong analytical and stakeholder management skills.

Responsibilities

• Assess EY external and internal attack surface using offensive security techniques across web, APIs, cloud, networks, and infrastructure.
• Test proof-of-concepts to validate exploitability and real-world impact.
• Emulate adversary tactics to test detection and response capabilities; conduct asset discovery.
• Support third‑party risk assessments and targeted testing where required; collaborate with security teams and business stakeholders.
• Help improve processes, playbooks and reporting standards within Vulnerability Discovery and offensive security functions.

Skills

Penetration testing

Red teaming

Threat emulation

Cloud security

Vulnerability assessment

Threat intelligence

Communication

Tools

Qualys

Nessus

Job description

EY is seeking an Offensive Security Analyst to evaluate and reduce EY's digital exposure through hands-on penetration testing and adversarial simulation. You will identify, assess and help mitigate vulnerabilities across EY’s global attack surface, emulating threat actors and validating exploitability while supporting third‑party risk assessments.

Join a team that strengthens Continuous Threat Exposure Management and Attack Surface Management, delivering actionable insights to improve proactive