Attack Surface Penetration Analyst

EY; Trenton (NJ); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Flexible vacation policy

Medical and dental coverage

Job summary

EY is seeking an Offensive Security Analyst on the Attack Surface Management team in the United States. You’ll perform hands-on penetration testing, emulate adversary tactics, and help reduce EY’s external and internal attack surface.

Collaborate with security engineers and stakeholders to prioritize remediation, strengthen threat detection, and improve playbooks and reporting. Required 4+ years in offensive security, OSCP preferable; EY offers hybrid work and a broad rewards package.

Qualifications

• Minimum of 4 years in penetration testing, red teaming, purple teaming or offensive security.
• Hands-on testing experience across applications, APIs, cloud, and networks.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting or performing third-party risk assessments.
• Strong analytical and problem-solving skills with risk prioritization.
• Strong communication and stakeholder management skills.

Responsibilities

• Assess EY’s external and internal attack surface identifying vulnerabilities.
• Test proof-of-concepts to validate exploitability and impact.
• Emulate adversary tactics to test detection and response capabilities.
• Collaborate with security engineering, blue teams, and stakeholders to prioritize remediation.
• Help enhance playbooks and reporting standards within vulnerability discovery.

Skills

Penetration testing

Red teaming

Threat assessment

Third-party risk

Communication

Job description

EY is seeking an Offensive Security Analyst on the Attack Surface Management team in the United States. You’ll perform hands-on penetration testing, emulate adversary tactics, and help reduce EY’s external and internal attack surface.

Collaborate with security engineers and stakeholders to prioritize remediation, strengthen threat detection, and improve playbooks and reporting. Required 4+ years in offensive security, OSCP preferable; EY offers hybrid work and a broad rewards package.