Attack Surface Validation & Exposure Engineer

Ernst & Young Advisory Services Sdn Bhd; Hoboken (NJ); On-site; USD 120,000 - 160,000; Full time

Job summary

EY is seeking an Attack Surface Validation & Exposure Engineer to join the Vulnerability Management and Exposure Assessment team. You will focus on attack path discovery, scalable vulnerability detection, and exposure validation with self-engineered solutions.

The role requires senior-level experience across vulnerability/exposure management and offensive security. You will collaborate with Red Team, Exposure Assessment, and Threat Detection teams to mitigate evolving threats and exposure across

Qualifications

• Minimum combined 8 years of experience in vulnerability management, exposure management, offensive security, and security engineering.
• Experience analyzing vulnerability and security posture data.
• Strong analytical and communication skills for senior stakeholders.

Responsibilities

• Design and engineer automated attack-path discovery and validation capabilities.
• Build scalable vulnerability detection and verification pipelines.
• Develop controlled exploitation and exploit-chaining workflows for demonstration of attacker outcomes.
• Operationalize continuous offensive validation with automated testing routines.
• Fuse Vulnerability Intelligence and Cyber Threat Intelligence into detection and prioritization efforts.
• Produce reproducible evidence, narratives, and remediation recommendations.

Skills

Attention to detail

Critical thinking

Security engineering

Offensive security

Communication

Autonomy

Job description

EY is seeking an Attack Surface Validation & Exposure Engineer to join the Vulnerability Management and Exposure Assessment team. You will focus on attack path discovery, scalable vulnerability detection, and exposure validation with self-engineered solutions.

The role requires senior-level experience across vulnerability/exposure management and offensive security. You will collaborate with Red Team, Exposure Assessment, and Threat Detection teams to mitigate evolving threats and exposure across