Attack Surface Security Analyst (Hybrid)

EY; Dallas (TX); Hybrid; USD 76,000 - 139,000; Full time

Job summary

EY in the United States seeks an Offensive Security Analyst to assess EY’s external and internal attack surface through hands-on penetration testing and adversarial simulation. Guided by the Exposure Management Lead, you will identify vulnerabilities and help mitigate risks across EY’s global ecosystem.

You will emulate adversary tactics, validate exploitability, and support third‑party risk assessments while collaborating with security engineering, blue teams, and stakeholders to strengthen

Qualifications

• A minimum of 4 years of experience in penetration testing, red teaming, purple teaming or offensive security
• Hands-on experience testing applications, APIs, cloud environments, and network infrastructure
• Strong understanding of common vulnerability classes such as OWASP Top 10 and exploitation techniques
• Familiarity with offensive security methodologies and frameworks
• Experience supporting or performing third-party risk assessments
• Strong analytical and problem-solving skills with the ability to prioritize risks effectively
• Strong communication and stakeholder management skills

Responsibilities

• Apply offensive security techniques to assess EY’s external and internal attack surface across web applications, APIs, cloud environments, networks and infrastructure
• Test proof-of-concepts to validate exploitability and real-world impact
• Emulate adversary tactics to test detection and response capabilities
• Conduct reconnaissance and asset discovery to uncover unmanaged or exposed assets
• Support third-party risk validation efforts and targeted testing where required
• Collaborate with security engineering, blue teams, and business stakeholders to prioritize remediation
• Contribute to improving processes, playbooks, and reporting standards within vulnerability discovery and offensive security

Job description

EY in the United States seeks an Offensive Security Analyst to assess EY’s external and internal attack surface through hands-on penetration testing and adversarial simulation. Guided by the Exposure Management Lead, you will identify vulnerabilities and help mitigate risks across EY’s global ecosystem.

You will emulate adversary tactics, validate exploitability, and support third‑party risk assessments while collaborating with security engineering, blue teams, and stakeholders to strengthen