Offensive Security Analyst — Attack Surface Expert

EY; Phoenix (AZ); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Medical and dental coverage

Pension and 401(k)

Job summary

EY in the United States is seeking an Offensive Security Analyst on the Attack Surface Management team to evaluate and reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will identify vulnerabilities across web apps, APIs, cloud environments, and networks, emulate threat actors, and help prioritize remediation with security engineers and stakeholders.

You will contribute to strengthening continuous threat exposure management and attack surface

Qualifications

• Minimum of 4 years of experience in penetration testing, red teaming, purple teaming or offensive security.
• Hands-on experience testing applications, APIs, cloud environments, and network infrastructure.
• Strong understanding of common vulnerability classes such as OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and frameworks.
• Experience supporting or performing third-party risk assessments.
• Strong analytical and problem-solving skills with the ability to prioritize risks.
• Strong communication and stakeholder management skills.

Responsibilities

• Identify vulnerabilities across EY’s external and internal attack surface; test web apps, APIs, cloud environments, networks and infrastructure.
• Emulate adversary tactics to test detection and response capabilities.
• Review assessments and conduct targeted testing for third-party risk validation.
• Collaborate with security engineering, blue teams and business stakeholders to prioritize remediation.
• Contribute to playbooks and reporting standards within Vulnerability Discovery and offensive security functions.

Skills

Penetration testing

Red team

Purple team

Offensive security

Threat modeling

Security analysis

Stakeholder management

Communication

Analytical thinking

Job description

EY in the United States is seeking an Offensive Security Analyst on the Attack Surface Management team to evaluate and reduce EY’s digital exposure through hands-on penetration testing and adversarial simulation. You will identify vulnerabilities across web apps, APIs, cloud environments, and networks, emulate threat actors, and help prioritize remediation with security engineers and stakeholders.

You will contribute to strengthening continuous threat exposure management and attack surface