Senior Attack Surface & Exposure Validation Engineer

EY; Cleveland (OH); On-site; USD 130,000 - 180,000; Full time

Job summary

EY is seeking an Attack Surface Validation & Exposure Engineer within Information Security. You will lead automated discovery of attack paths, validate vulnerabilities at scale, and develop exploitation workflows to demonstrate outcomes.

The role collaborates with Red Team, Exposure Assessment, and Threat Intelligence to prioritize threats and enable remediation. The ideal candidate brings extensive experience in vulnerability and exposure management, and can operate autonomously in a global

Qualifications

• Minimum combined experience in vulnerability and exposure management, offensive security and security engineering.
• Experience analyzing vulnerability data and security posture.
• Ability to build scalable solutions and communicate with senior stakeholders.

Responsibilities

• Design and engineer automated attack-path discovery and validation capabilities.
• Build scalable vulnerability detection and verification pipelines with enterprise scanning sources and custom validation logic.
• Develop controlled exploitation and exploit-chaining workflows to demonstrate real attacker outcomes.
• Operationalize continuous offensive validation with autonomous testing routines.
• Fuse Vulnerability Intelligence and Cyber Threat Intelligence into detection and prioritization.
• Produce reproducible evidence, attack-path narratives, remediation recommendations.
• Collaborate with Red Team, Exposure Assessment, Threat Detection, and VM stakeholders.

Skills

Vulnerability management

Exposure management

Offensive security

Security engineering

Analytical skills

Stakeholder communication

Job description

EY is seeking an Attack Surface Validation & Exposure Engineer within Information Security. You will lead automated discovery of attack paths, validate vulnerabilities at scale, and develop exploitation workflows to demonstrate outcomes.

The role collaborates with Red Team, Exposure Assessment, and Threat Intelligence to prioritize threats and enable remediation. The ideal candidate brings extensive experience in vulnerability and exposure management, and can operate autonomously in a global