Senior Attack Surface & Exposure Engineer

EY; Los Angeles (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

EY in Los Angeles is seeking a senior Attack Surface Validation & Exposure Engineer to lead attack-path discovery and validation, and to build scalable vulnerability detection pipelines with automated validation logic.

You will develop exploitation workflows to safely demonstrate attacker outcomes and work with Red Team, Exposure Assessment, Threat Detection, and VM stakeholders to prioritize and remediate exposures, delivering concrete remediation guidance.

Qualifications

• 8+ years in vulnerability/exposure management and security engineering.
• Experience analyzing vulnerability posture data and attack paths.
• Ability to build scalable vulnerability/exposure solutions.
• Experience communicating with senior security leadership.
• Ability to work independently in a global environment.

Responsibilities

• Design automated attack-path discovery and validation capabilities.
• Build scalable vulnerability detection pipelines with validation logic.
• Develop exploitation workflows to demonstrate attacker outcomes.
• Operationalize continuous offensive validation with minimal prompts.
• Integrate Vulnerability Intelligence with Threat Intelligence for prioritization.
• Deliver reproducible evidence and remediation recommendations.
• Collaborate with Red Team, VM, Threat Detection, and stakeholders.

Skills

Attack surface

Vulnerability management

Offensive security

Automation engineering

Threat intelligence

Communication skills

Stakeholder engagement

Tools

Vulnerability scanners

Exploitation frameworks

Automation tools

Job description

EY in Los Angeles is seeking a senior Attack Surface Validation & Exposure Engineer to lead attack-path discovery and validation, and to build scalable vulnerability detection pipelines with automated validation logic.

You will develop exploitation workflows to safely demonstrate attacker outcomes and work with Red Team, Exposure Assessment, Threat Detection, and VM stakeholders to prioritize and remediate exposures, delivering concrete remediation guidance.