Attack Surface Security Analyst — Pen Testing & Emulation

EY; Honolulu (HI); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY is seeking an Offensive Security Analyst on the Attack Surface Management team to reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation, under the guidance of the Exposure Management Lead.

You will identify vulnerabilities across EY’s web apps, APIs, cloud, networks, and infrastructure; test exploits and real-world impact; and contribute to strengthening proactive defense.

Qualifications

• 4+ years of experience in penetration testing, red/purple teaming or offensive security.
• Hands-on testing of applications, APIs, cloud environments and networks.
• Understanding of common vulnerability classes such as OWASP Top 10.
• Experience supporting third-party risk assessments.

Responsibilities

• Assess EY's external and internal attack surface for vulnerabilities.
• Emulate adversary tactics to test detection and response capabilities.
• Support third-party risk assessments and targeted testing where required.
• Collaborate with security engineering and stakeholders to prioritize remediations.

Skills

Offensive security

Penetration testing

Vulnerability scanning tools

OWASP Top 10

Cloud environments

Threat intelligence

Tools

Qualys

Nessus

Job description

EY is seeking an Offensive Security Analyst on the Attack Surface Management team to reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation, under the guidance of the Exposure Management Lead.

You will identify vulnerabilities across EY’s web apps, APIs, cloud, networks, and infrastructure; test exploits and real-world impact; and contribute to strengthening proactive defense.