Senior Penetration Tester & Red Team Lead

EY; Grand Rapids (MI); On-site; USD 120,000 - 190,000; Full time

Job summary

EY is seeking a Senior Attack & Penetration Tester to join our security practice. You will plan, lead and execute sophisticated penetration tests and red team engagements, applying threat-informed approaches to identify exploitable paths across AD, cloud, APIs, and mobile environments.

You will translate findings into clear remediation guidance for technical teams and executives, mentor junior staff, and drive testing programs with cross-functional client teams.

Qualifications

• Extensive experience planning and leading penetration tests and red team engagements.
• Experience across external/internal networks, AD, cloud, APIs, mobile, and web environments.
• Knowledge of MITRE ATT&CK framework and adversary tactics.
• Ability to translate testing results into remediation strategies for technical and executive audiences.
• Willingness to travel up to 80% domestically and internationally.

Responsibilities

• Plan, lead, and execute complex penetration tests and advanced red team engagements.
• Apply threat-informed testing to emulate adversary behavior and identify exploitable paths.
• Test across AD, cloud, APIs, web/mobile apps, wireless networks, and physical security as allowed.
• Translate results into actionable risk insights and remediation recommendations for clients.
• Mentor junior team members and contribute to methodology development.
• Coordinate testing activities and manage multiple workstreams.

Skills

Penetration testing

Red team engagements

Threat-informed testing

MITRE ATT&CK

Leadership & coaching

Executive communication

Travel readiness

Job description

EY is seeking a Senior Attack & Penetration Tester to join our security practice. You will plan, lead and execute sophisticated penetration tests and red team engagements, applying threat-informed approaches to identify exploitable paths across AD, cloud, APIs, and mobile environments.

You will translate findings into clear remediation guidance for technical teams and executives, mentor junior staff, and drive testing programs with cross-functional client teams.