Senior Cyber & AI Penetration Tester

EY; Houston (TX); On-site; USD 105,000 - 210,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY is seeking a Senior Attack & Penetration Tester to lead and execute sophisticated offensive security operations across diverse client environments. You will apply intelligence-led testing to emulate adversaries, identify exploitable paths, and evaluate protections.

The role spans external/internal networks, AD, cloud, APIs, mobile and web apps, and requires collaboration with client teams to remediate weaknesses.

Qualifications

• Bachelor's degree in a related field and 5+ years in offensive security.
• Hands-on experience in planning and executing advanced red team engagements.
• Experience with external/internal network testing, AD, cloud, wireless, APIs, web/mobile apps.
• Familiarity with MITRE ATT&CK framework and offensive security tooling.
• Two relevant offensive security certifications (e.g., OSCP, OSCE, GXPN).
• Willingness to travel up to 80 percent domestically and internationally.

Responsibilities

• Plan, lead, and execute complex penetration tests and red team engagements.
• Emulate adversaries, identify attack paths, and evaluate security controls.
• Produce client-ready reports and executive summaries with remediation steps.
• Mentor junior team members and contribute to methodology development.
• Coordinate testing activities with client teams within rules of engagement.
• Communicate complex concepts clearly to technical and non-technical stakeholders.
• Lead remote and on-site technical teams and manage testing deliverables.

Skills

Advanced problem solving

Penetration testing

Red team engagements

Threat-informed testing

Team leadership

Communication to executives

Remote and on-site leadership

Education

Bachelor's degree in Computer Science / Cybersecurity

Job description

EY is seeking a Senior Attack & Penetration Tester to lead and execute sophisticated offensive security operations across diverse client environments. You will apply intelligence-led testing to emulate adversaries, identify exploitable paths, and evaluate protections.

The role spans external/internal networks, AD, cloud, APIs, mobile and web apps, and requires collaboration with client teams to remediate weaknesses.