Attack Surface Penetration Specialist

EY; Lansing (MI); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Medical & dental coverage

401(k) plan

Hybrid workplace model

Paid time off

Job summary

EY is seeking an Offensive Security Analyst to reduce EY’s digital exposure through hands-on penetration testing, adversarial simulation, and vulnerability assessment across web apps, APIs, cloud, networks, and infrastructure.

You will work under the Exposure Management Lead to identify risks, validate exploits, and help strengthen threat exposure management and incident response capabilities. Hybrid work model applies in most engagements.

Qualifications

• 4+ years in penetration testing, red/purple teaming or offensive security.
• Hands-on testing of applications, APIs, cloud environments and networks.
• Strong understanding of common vulnerability classes such as OWASP Top 10 and exploit techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting or performing third-party risk assessments.
• Strong analytical and problem-solving skills with risk prioritization.
• Strong communication and stakeholder management skills.

Responsibilities

• Assess EY’s external and internal attack surface by identifying vulnerabilities in web apps, APIs, cloud, networks and infrastructure.
• Emulate adversary tactics to test detection and response and validate exploitability.
• Conduct asset discovery and reconnaissance to uncover unmanaged or exposed assets.
• Support third-party risk validation and collaborate with security teams to prioritize remediation.

Skills

Penetration testing

Adversarial testing

Vulnerability assessment

OWASP Top 10

Cloud security

Tools

Qualys

Nessus

Job description

EY is seeking an Offensive Security Analyst to reduce EY’s digital exposure through hands-on penetration testing, adversarial simulation, and vulnerability assessment across web apps, APIs, cloud, networks, and infrastructure.

You will work under the Exposure Management Lead to identify risks, validate exploits, and help strengthen threat exposure management and incident response capabilities. Hybrid work model applies in most engagements.