Senior Attack Surface & Exposure Engineer

EY; Philadelphia (Philadelphia County); On-site; USD 130,000 - 210,000; Full time

Job summary

EY Information Security is seeking an Attack Surface Validation & Exposure Engineer in Philadelphia to lead autonomous, strategic efforts in discovering and managing vulnerabilities across EY digital assets. You will design automated attack-path discovery, develop scalable detection pipelines, and engineer controlled exploitation workflows to demonstrate real attacker outcomes.

You will partner with Red Team, Exposure Assessment, Threat Detection, and Vulnerability Management to tailor

Qualifications

• Minimum 8 years in vulnerability management, exposure management, offensive security and security engineering.
• Experience analyzing vulnerability and security posture data.
• Deep understanding of attack paths, misconfigurations and control failures that drive risk.
• Proven ability to build scalable vulnerability and exposure solutions.
• Experience at a strategic level balancing depth with risk context.
• Strong analytical skills for large data sets.
• Excellent communication with senior stakeholders and leadership.
• Ability to manage competing priorities in a global environment.

Responsibilities

• Design automated attack-path discovery and validation capabilities.
• Build scalable vulnerability detection pipelines with enterprise scanners and custom logic.
• Develop controlled exploitation workflows to demonstrate attacker outcomes.
• Automate offensive validation with minimal human prompting.
• Fuse vulnerability and threat intelligence into detection and prioritization.
• Produce reproducible evidence and remediation recommendations for stakeholders.
• Collaborate with Red Team, Exposure Assessment, Threat Detection and VM teams.

Skills

Attack surface discovery

Vulnerability management

Offensive security

Security engineering

Cyber threat intelligence

Strong communication

Analytical thinking

Independent work

Job description

EY Information Security is seeking an Attack Surface Validation & Exposure Engineer in Philadelphia to lead autonomous, strategic efforts in discovering and managing vulnerabilities across EY digital assets. You will design automated attack-path discovery, develop scalable detection pipelines, and engineer controlled exploitation workflows to demonstrate real attacker outcomes.

You will partner with Red Team, Exposure Assessment, Threat Detection, and Vulnerability Management to tailor