Offensive Security Analyst: Attack Surface & Pen Testing

Ernst and Young; Carson City (NV); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Hybrid work model

Job summary

EY seeks an Offensive Security Analyst to reduce EY's digital exposure through hands-on penetration testing and adversarial simulation. You will identify vulnerabilities across EY’s global attack surface, validate third-party risk assessments, and help strengthen threat exposure management and defense.

Join a team of security professionals dedicated to protecting EY and client information assets while delivering secure products and services in a hybrid work environment.

Qualifications

• Minimum 4 years of experience in penetration testing, red teaming or offensive security.
• Hands-on testing of applications, APIs, cloud environments and networks.
• Familiarity with OWASP Top 10 and exploitation techniques.
• Experience supporting third-party risk assessments is a plus.

Responsibilities

• Assess EY external and internal attack surfaces using offensive security methods.
• Emulate adversary tactics to test detection and response capabilities.
• Identify misconfigurations and exposed assets across web apps, APIs, cloud, networks and infrastructure.
• Collaborate with security engineering and business stakeholders to prioritize remediation.

Skills

Penetration testing

Red teaming

Offensive security

Vulnerability assessment

Threat intelligence

Cloud security

APIs security

Network security

Communication

Education

OSCP

GPEN

GWAPT

Tools

Qualys

Nessus

Job description

EY seeks an Offensive Security Analyst to reduce EY's digital exposure through hands-on penetration testing and adversarial simulation. You will identify vulnerabilities across EY’s global attack surface, validate third-party risk assessments, and help strengthen threat exposure management and defense.

Join a team of security professionals dedicated to protecting EY and client information assets while delivering secure products and services in a hybrid work environment.