Attack Surface Penetration Specialist

EY; Hartford (CT); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

EY is seeking an Offensive Security Analyst to join the Attack Surface Management team. You will perform hands-on penetration testing and adversarial simulations to reduce EY’s digital exposure, identifying vulnerabilities across web apps, APIs, cloud environments, networks, and infrastructure.

You’ll emulate threat actors, validate exploitability, and collaborate with security engineers to prioritize remediation.

Qualifications

• Minimum of 4 years in penetration testing, red/purple teaming or offensive security.
• Hands-on testing of applications, APIs, cloud environments, and networks.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Experience supporting or performing third‑party risk assessments.
• Strong analytical and problem-solving skills with the ability to prioritize risks.

Responsibilities

• Assess EY’s external and internal attack surface across web apps, APIs, cloud, networks and infrastructure.
• Emulate adversary tactics to test detection and response capabilities and validate exploitability.
• Conduct reconnaissance and asset discovery to identify exposed assets.
• Collaborate with security engineering, blue teams and stakeholders to prioritize remediation by risk.
• Help improve playbooks, reporting standards and processes within offensive security.

Skills

Penetration testing

Red/Purple teaming

Cloud environments

APIs & web apps

Threat intelligence

Stakeholder communication

Adversarial simulation

Job description

EY is seeking an Offensive Security Analyst to join the Attack Surface Management team. You will perform hands-on penetration testing and adversarial simulations to reduce EY’s digital exposure, identifying vulnerabilities across web apps, APIs, cloud environments, networks, and infrastructure.

You’ll emulate threat actors, validate exploitability, and collaborate with security engineers to prioritize remediation.