Offensive Security Analyst

Responsibilities

• Apply offensive security techniques to assess EY’s external and internal attack surface, including web applications, APIs, cloud environments, and network infrastructure.
• Emulate adversary tactics to test detection and response capabilities through hands-on penetration testing and adversarial simulation.
• Conduct reconnaissance and asset discovery to identify unmanaged or exposed assets.
• Test proof-of-concepts to validate exploitability and determine real-world business impact.
• Support third-party and supply chain risk validation efforts through targeted testing and assessment reviews.
• Collaborate with security engineering, blue teams, and business stakeholders to prioritize remediation efforts based on risk severity.

Requirements

• Minimum of 4 years of experience in penetration testing, red teaming, purple teaming, or offensive security.
• Hands-on experience testing applications, APIs, cloud environments, and network infrastructure.
• Strong understanding of common vulnerability classes, including the OWASP Top 10.
• Familiarity with offensive security methodologies and frameworks.
• Strong analytical, problem-solving, and communication skills to convey technical findings to diverse audiences.
• Experience supporting or performing third-party risk assessments.

Preferred Qualifications

• Professional certifications such as OSCP, GPEN, GWAPT, or equivalent offensive security credentials.

Benefits

• Competitive base salary ranging from $76,400 to $138,600 (location dependent).
• Comprehensive medical and dental coverage.
• Pension and 401(k) plans.
• Flexible vacation policy and designated EY paid holidays.
• Hybrid work model allowing for flexible, team-led engagement.

About the Company

EY is a global leader in assurance, consulting, tax, and strategy services. Our Information Security team works to protect EY and our clients by blending risk strategy, cyber defense, and application security to build a more secure digital world.