Attack Surface & Penetration Analyst - Hybrid

EY; Madison (WI); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k) plans

Paid time off options

Job summary

EY is seeking an Offensive Security Analyst to reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will emulate threat actors, identify vulnerabilities across web apps, APIs, cloud and networks, and assess real-world impact.

You’ll collaborate with security engineering and stakeholders to prioritize remediation and strengthen threat exposure management. The role supports a hybrid model with opportunities to grow within a diverse, globally connected

Qualifications

• 4+ years of experience in penetration testing, red teaming, purple teaming or offensive security
• Hands-on experience testing applications, APIs, cloud environments, and network infrastructure
• Strong understanding of OWASP Top 10 and exploitation techniques
• Experience supporting or performing third-party risk assessments
• Strong analytical and problem-solving skills with the ability to prioritize risks effectively
• Strong communication and stakeholder management skills

Responsibilities

• Assess EY's external and internal attack surface, identifying vulnerabilities across web apps, APIs, cloud environments, networks and infrastructure
• Test proof-of-concepts to validate exploitability and real-world impact
• Emulate adversary tactics to test detection and response capabilities
• Collaborate with security engineering, blue teams, and business stakeholders to prioritize remediation
• Contribute to playbooks and reporting standards within Vulnerability Discovery and offensive security functions

Skills

Identify vulnerabilities

Exploit vulnerabilities

Attention to detail

Critical thinking

Prioritize risks

Communicate findings

Threat intelligence

Job description

EY is seeking an Offensive Security Analyst to reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will emulate threat actors, identify vulnerabilities across web apps, APIs, cloud and networks, and assess real-world impact.

You’ll collaborate with security engineering and stakeholders to prioritize remediation and strengthen threat exposure management. The role supports a hybrid model with opportunities to grow within a diverse, globally connected