Penetration Testing Manager - Offensive Security

EY; Des Moines (IA); On-site; USD 145,000 - 290,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k) plans

Paid time off

Job summary

EY is seeking a Manager in the Attack & Penetration Testing team to lead offensive security engagements and drive resilience for clients. You will mentor analysts, oversee test delivery, and report findings to both technical and executive audiences.

The role requires extensive penetration testing experience, leadership capability, and up-to-date knowledge of threats and ATT&CK techniques. Domestic and international travel may be required.

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity or related field with extensive penetration testing experience.
• Experience managing and executing penetration testing projects.
• Experience with manual attack/penetration testing.
• Experience leading Red Team or application penetration programs.
• Scripting/programming skills (Python, PowerShell, Java, Perl).
• Willingness to travel domestically and internationally (up to 50%).

Responsibilities

• Identify threats and vulnerabilities in enterprise environments.
• Lead teams in penetration testing, red team and purple team exercises.
• Deliver clear, concise, actionable reports for technical and executive audiences.
• Mentor analysts and foster a collaborative culture.
• Stay updated on cyber threats and industry best practices.
• Manage multiple penetration testing projects within rules of engagement.

Skills

Penetration testing

Red team

Purple team

Team leadership

Python scripting

Driver's license

Clear verbal/written communications

Education

OSCP/OSWP/GIAC CISSP etc certifications

Tools

NIST/ATT&CK

Penetration testing tools

Job description

EY is seeking a Manager in the Attack & Penetration Testing team to lead offensive security engagements and drive resilience for clients. You will mentor analysts, oversee test delivery, and report findings to both technical and executive audiences.

The role requires extensive penetration testing experience, leadership capability, and up-to-date knowledge of threats and ATT&CK techniques. Domestic and international travel may be required.