Senior AI‑Enabled Penetration Tester

EY; Baltimore (MD); On-site; USD 115,000 - 210,000; Full time

Job summary

EY is seeking a Senior Attack & Penetration Tester to lead complex penetration tests and red team engagements for diverse clients. You will emulate adversaries, identify exploitation paths, and evaluate security controls across AD, cloud, web, mobile, APIs, and network environments.

You will translate findings into actionable remediation, mentor junior teammates, and help evolve EY’s offensive security capabilities while traveling as needed.

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, MIS, IT, Engineering or related field with at least five years of offensive security experience.
• Hands-on experience planning and executing advanced red team engagements and adversary emulation.
• External and internal network penetration testing experience including enumeration, exploitation, escalation, lateral movement.
• Experience assessing Active Directory environments incl. domain/trust configurations and credential exposure.
• Cloud security testing experience incl. IAM, exposed services, misconfigurations and attack-path analysis.
• Wireless security assessments including configuration, controls and testing techniques.
• Web/mobile/API security testing using manual techniques and methodologies.
• Experience evaluating security configurations and system hardening with remediation guidance.
• Scripting or programming languages to automate testing (Python, PowerShell, Bash, C#, Go, Rust, Java).
• Experience with commercial/open-source pentesting tools and adapting techniques to client environments.
• Familiarity with EDR/SIEM and defensive controls affecting testing.
• Experience with red team C2 platforms and operational infrastructure.
• Ability to bypass EDR and defensive controls during authorized engagements.
• Working knowledge of MITRE ATT&CK and current vulnerabilities/tactics.
• Experience leading remote/on-site teams and communicating testing risks clearly.
• Ability to develop clear technical findings with evidence and remediation guidance.
• Two offensive security certifications (e.g., OSCP, GPEN, GWAPT, CREST CRT, etc.).
• Willingness to travel up to 80% domestically and internationally.

Responsibilities

• Plan, lead, and execute complex penetration tests and red team engagements.
• Apply threat-informed testing to emulate realistic adversary behaviors.
• Test across external/internal networks, AD, cloud, wireless, web, mobile, and APIs.
• Translate results into clear findings and remediation actions for clients and EY leadership.
• Lead workstreams, mentor juniors, and contribute to methodology development.
• Stay current on vulnerabilities, tooling, and industry research.

Skills

Problem-solving

Penetration testing

Red team

Threat-informed testing

Team leadership

Risk communication

Technical reporting

Executive communication

Cross-functional teamwork

Education

Bachelor's degree in CS/Engineering/Cybersecurity

Job description

EY is seeking a Senior Attack & Penetration Tester to lead complex penetration tests and red team engagements for diverse clients. You will emulate adversaries, identify exploitation paths, and evaluate security controls across AD, cloud, web, mobile, APIs, and network environments.

You will translate findings into actionable remediation, mentor junior teammates, and help evolve EY’s offensive security capabilities while traveling as needed.