Offensive Security Analyst: Pen Test & Attack Surface

Ernst and Young; Springfield (IL); Hybrid; USD 76,000 - 139,000; Full time

Benefits offered by this job

Hybrid work model

Flexible vacation policy

Total Rewards package (medical, dental

and pension/401(k)

Job summary

EY in the United States is seeking an Offensive Security Analyst to join the Attack Surface Management team. You will perform hands-on penetration testing, emulate threat actors, and help reduce EY’s external and internal exposure across web apps, APIs, cloud, networks and infrastructure.

You’ll collaborate with security engineers and stakeholders to prioritize remediation, validate third-party risk assessments, and strengthen detection, response and proactive defense.

Qualifications

• 4+ years of experience in penetration testing, red teaming, or offensive security.
• Experience testing applications, APIs, cloud environments, and networks.
• Strong understanding of OWASP Top 10 and exploitation techniques.
• Familiarity with offensive security methodologies and third-party risk assessments.
• Strong analytical and problem-solving skills with the ability to prioritize risks.
• Excellent communication and stakeholder management skills.

Responsibilities

• Assess EY’s external and internal attack surface using offensive security techniques.
• Test applications, APIs, cloud environments, networks, and infrastructure for exploitable weaknesses.
• Support third-party risk assessments and remediation prioritization.
• Collaborate with security engineering, blue teams, and business stakeholders to strengthen detection and response.

Skills

Penetration testing

Vulnerability assessment

Threat emulation

Cloud security

Network security

API security

Security collaboration

Communication

Tools

Qualys

Nessus

Job description

EY in the United States is seeking an Offensive Security Analyst to join the Attack Surface Management team. You will perform hands-on penetration testing, emulate threat actors, and help reduce EY’s external and internal exposure across web apps, APIs, cloud, networks and infrastructure.

You’ll collaborate with security engineers and stakeholders to prioritize remediation, validate third-party risk assessments, and strengthen detection, response and proactive defense.