Senior Penetration Tester & Red Team Lead

EY; Los Angeles (CA); On-site; USD 105,000 - 219,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY is seeking a Senior Attack & Penetration Tester to lead sophisticated offensive security engagements across diverse client environments. You will emulate adversaries, identify attack paths, and evaluate security controls, working across AD, cloud, APIs, web/mobile apps, and networks.

You will mentor junior staff and shape testing methodologies while communicating risks to technical and executive audiences.

Qualifications

• Bachelor's degree in a related field and at least five years of offensive security experience.
• Hands-on experience planning and executing advanced red team engagements.
• Experience in external/internal network testing, AD, cloud, wireless, web, and APIs.
• Ability to translate findings into actionable remediation guidance.
• Ability to lead remote and on-site technical teams within ROE.

Responsibilities

• Plan, lead, and execute complex penetration tests and red team engagements.
• Emulate realistic adversary behaviors and identify exploitable attack paths.
• Evaluate preventive, detective, and responsive security controls.
• Cover external/internal networks, AD, cloud, APIs, web and mobile apps.
• Translate results into clear insights for technical and executive audiences.
• Lead workstreams, mentor juniors, and contribute to methodology development.

Skills

Offensive security testing

Red team engagements

MITRE ATT&CK framework

Vulnerability identification

AD and identity security

Cloud security testing

Scripting languages (Python/PowerShell

Team leadership/coaching

Communication to executives

Education

Bachelor's degree in Computer Science / related field

Job description

EY is seeking a Senior Attack & Penetration Tester to lead sophisticated offensive security engagements across diverse client environments. You will emulate adversaries, identify attack paths, and evaluate security controls, working across AD, cloud, APIs, web/mobile apps, and networks.

You will mentor junior staff and shape testing methodologies while communicating risks to technical and executive audiences.