Offensive Security Analyst - Attack Surface Expert

EY; Boston (MA); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Medical and dental coverage

Pension and 401(k)

Job summary

EY is seeking an Offensive Security Analyst to join the Attack Surface Management team. You will apply hands-on offensive security to identify and reduce EY’s digital exposure through testing across web apps, APIs, cloud environments, networks, and infrastructure.

You will emulate adversary tactics, validate exploitability, and help prioritize remediation with stakeholders. A strong background in offensive security, OSCP/GPEN/GWAPT or equivalent certs, and experience with third-party risk

Qualifications

• 4+ years in penetration testing, red/purple team or offensive security.
• Hands-on testing of apps, APIs, cloud, and networks.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Experience supporting third-party risk assessments.

Responsibilities

• Apply offensive security techniques to assess EY's external and internal attack surface across web apps, APIs, cloud, networks, and infrastructure.
• Perform reconnaissance, exploitability testing, and validate exploitability with PoCs.
• Emulate adversary tactics to test detection and response capabilities.
• Collaborate with security engineering, blue teams, and stakeholders to prioritize remediation by risk.

Skills

Penetration testing

Red/Purple team

Cloud/API testing

Vulnerability analysis

Threat intelligence

Stakeholder communication

Education

OSCP/GPEN/GWAPT certification

Tools

Qualys

Nessus

Job description

EY is seeking an Offensive Security Analyst to join the Attack Surface Management team. You will apply hands-on offensive security to identify and reduce EY’s digital exposure through testing across web apps, APIs, cloud environments, networks, and infrastructure.

You will emulate adversary tactics, validate exploitability, and help prioritize remediation with stakeholders. A strong background in offensive security, OSCP/GPEN/GWAPT or equivalent certs, and experience with third-party risk