Hybrid Offensive Security Analyst - Attack Surface

Work in Iowa; Des Moines (IA); Hybrid; USD 76,000 - 139,000; Full time

Job summary

EY is seeking an Offensive Security Analyst to evaluate and reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will identify and help mitigate vulnerabilities across EY’s global attack surface, including third-party risk validation and asset discovery, while improving threat exposure management.

The role requires 4+ years in offensive security with hands-on testing across apps, APIs, cloud, and networks.

Qualifications

• A minimum of 4 years of experience in penetration testing, red teaming, purple teaming or offensive security.
• Hands-on experience testing applications, APIs, cloud environments, and network infrastructure.
• Strong understanding of common vulnerability classes such as OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting or performing third‑party risk assessments.
• Strong analytical and problem-solving skills with the ability to prioritize risks effectively.
• Strong communication and stakeholder management skills.

Responsibilities

• Assess EY’s external and internal attack surface and identify vulnerabilities across web apps, APIs, cloud, networks.
• Test proof-of-concepts to validate exploitability and real-world impact.
• Emulate adversary tactics to test detection and response capabilities.
• Collaborate with security engineering and stakeholders to prioritize remediation.
• Support third-party risk assessments and supply chain testing.

Skills

Penetration testing

Red teaming

Purple teaming

APIs testing

Cloud environments

Network infrastructure

Threat intelligence

Communication skills

Tools

Qualys

Nessus

Job description

EY is seeking an Offensive Security Analyst to evaluate and reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will identify and help mitigate vulnerabilities across EY’s global attack surface, including third-party risk validation and asset discovery, while improving threat exposure management.

The role requires 4+ years in offensive security with hands-on testing across apps, APIs, cloud, and networks.