Senior AI-Driven Penetration Tester

EY; San Jose (CA); On-site; USD 131,000 - 219,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k) plans

Paid time off

Job summary

EY is seeking a Senior Attack & Penetration Tester to advance client resilience through offensive security engagements across networks, cloud, and applications. You will emulate adversaries, identify attack paths, and provide remediation guidance while leading testing activities and mentoring junior staff.

The role requires hands-on testing across AD, cloud, web, mobile, and APIs, plus strong communication to executives and stakeholders. Travel up to 80% may be required.

Qualifications

• Bachelor's degree and at least five years of offensive security experience.
• Hands-on experience planning and executing advanced red team engagements.
• External and internal network penetration testing experience.
• Experience assessing Active Directory environments.
• Cloud security testing experience.
• Wireless, web, mobile, and API testing experience.
• Experience with scripting/programming for automation (Python, PowerShell, Bash, etc.).
• Experience with red team C2 platforms and offensive tooling.

Responsibilities

• Plan, lead, and execute complex penetration testing and red team engagements across diverse client environments.
• Apply intelligence-led, threat-informed testing to emulate adversaries and identify exploitable paths.
• Translate findings into actionable remediation guidance for technical and executive audiences.
• Lead technical workstreams, mentor junior team members, and coordinate testing activities.

Skills

Threat-informed testing

MITRE ATT&CK

Penetration testing

Red team engagements

Cloud security testing

Active Directory

Identity security

Python

PowerShell

Bash

C#

Go

Rust

Java

Education

Bachelor's degree in Computer Science/Engineering/Cybersecurity or related field

Tools

Industry testing tools

Job description

EY is seeking a Senior Attack & Penetration Tester to advance client resilience through offensive security engagements across networks, cloud, and applications. You will emulate adversaries, identify attack paths, and provide remediation guidance while leading testing activities and mentoring junior staff.

The role requires hands-on testing across AD, cloud, web, mobile, and APIs, plus strong communication to executives and stakeholders. Travel up to 80% may be required.