Senior Attack Surface & Exposure Engineer

EY; Secaucus (NJ); On-site; USD 120,000 - 160,000; Full time

Job summary

EY in Secaucus, NJ is seeking an Attack Surface Validation & Exposure Engineer to join the Vulnerability Management and Exposure Assessment capability. You will design automated attack-path discovery, build scalable detection pipelines, and develop exploitation workflows to demonstrate real attacker outcomes.

You’ll collaborate with Red Team and Threat Intelligence, report findings with reproducible evidence, and help shape EY’s security posture for EY digital assets.

Qualifications

• Minimum 8 years of experience in vulnerability, exposure, offensive security, and security engineering.
• Proven ability to build scalable solutions for vulnerability challenges.
• Strong analytical skills to evaluate large data sets and influence solutions.
• Excellent communication with senior stakeholders and security leadership.
• Experience operating at a strategic level balancing depth with risk context.
• Experience leveraging AI for exposure assessments.

Responsibilities

• Design and engineer automated attack-path discovery and validation capabilities.
• Build scalable vulnerability detection and verification pipelines.
• Develop controlled exploitation and exploit-chaining workflows.
• Operationalize continuous offensive validation with minimal prompting.
• Fuse Vulnerability Intelligence and Cyber Threat Intelligence into detection and prioritization.
• Produce reproducible evidence and remediation guidance.
• Partner across Red Team, Exposure Assessment, Threat Detection, and VM stakeholders.

Skills

Attention to detail

Critical thinking

Offensive security

Vulnerability management

Security engineering

Technical communication

Autonomy

Adaptability

Job description

EY in Secaucus, NJ is seeking an Attack Surface Validation & Exposure Engineer to join the Vulnerability Management and Exposure Assessment capability. You will design automated attack-path discovery, build scalable detection pipelines, and develop exploitation workflows to demonstrate real attacker outcomes.

You’ll collaborate with Red Team and Threat Intelligence, report findings with reproducible evidence, and help shape EY’s security posture for EY digital assets.