Senior Offensive Security Consultant

Ernst & Young Oman; Cleveland (OH); On-site; USD 105,000 - 192,000; Full time

Job summary

EY is seeking a Senior Attack & Penetration Tester in the United States to advance client resilience through offensive security engagements across networks, AD, cloud, APIs, web and mobile apps. You will lead testing efforts and translate findings into remediation with risk-based recommendations.

The role emphasizes threat-informed testing, engagement governance, and clear communication with technical and executive audiences, with travel up to 80% to meet client needs.

Qualifications

• A bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, MIS, IT, Engineering, or related field.
• Five+ years of offensive security experience.
• Hands-on experience planning and executing red team engagements.
• Experience in external and internal network pentesting including AD, cloud, web, APIs.
• Proficiency with scripting languages to automate testing (Python/PowerShell/Bash/Java).

Responsibilities

• Plan, lead, and execute complex penetration tests and red team engagements.
• Translate testing results into clear, actionable remediation guidance for client environments.
• Collaborate with client teams to validate weaknesses and develop mitigations.
• Mentor junior team members and contribute to methodology development.
• Maintain knowledge of evolving vulnerabilities and offensive security tooling.

Skills

Penetration testing

Red team

Active Directory

Cloud security

APIs testing

MITRE ATT&CK

Python

PowerShell

Education

Bachelor's degree in CS/CE/ Cybersecurity

Tools

EDR

SIEM

C2 platforms

Public exploits

Job description

EY is seeking a Senior Attack & Penetration Tester in the United States to advance client resilience through offensive security engagements across networks, AD, cloud, APIs, web and mobile apps. You will lead testing efforts and translate findings into remediation with risk-based recommendations.

The role emphasizes threat-informed testing, engagement governance, and clear communication with technical and executive audiences, with travel up to 80% to meet client needs.