Attack Surface & Penetration Testing Analyst

EY; Frankfort (KY); Hybrid; USD 76,000 - 139,000; Full time

Job summary

EY is seeking an Offensive Security Analyst to evaluate EY’s external and internal attack surface through hands-on penetration testing and adversarial simulation. You will identify vulnerabilities across web, API, cloud, networks, and infrastructure, and help prioritize remediation with a focus on risk and exploitability.

Joining EY means contributing to Continuous Threat Exposure Management and Attack Surface Management efforts within a global team, while working in a hybrid model in the United

Qualifications

• Minimum 4 years in penetration testing, red/purple/purple teaming or offensive security.
• Hands-on testing of applications, APIs, cloud environments, and networks.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting or performing third-party risk assessments.
• Strong analytical and problem-solving skills with stakeholder management.

Responsibilities

• Apply offensive security techniques to assess EY’s external and internal attack surface.
• Emulate adversary tactics to test detection and response capabilities.
• Prioritize remediation efforts based on risk severity and exploitability.
• Collaborate with security engineering, blue teams, and business stakeholders to strengthen defenses.
• Contribute to playbooks, reporting standards, and vulnerability discovery processes.

Skills

Penetration testing

Red teaming

Offensive security

Vulnerability assessment

Threat intelligence

Cloud security

Tools

Qualys

Nessus

Job description

EY is seeking an Offensive Security Analyst to evaluate EY’s external and internal attack surface through hands-on penetration testing and adversarial simulation. You will identify vulnerabilities across web, API, cloud, networks, and infrastructure, and help prioritize remediation with a focus on risk and exploitability.

Joining EY means contributing to Continuous Threat Exposure Management and Attack Surface Management efforts within a global team, while working in a hybrid model in the United