Senior Penetration Testing Consultant

Senior Penetration Tester | Cybersecurity

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture, and technology to become the best version of yourself. We’re counting on your unique voice and perspective to help EY become even better. Join us and build an exceptional experience for yourself and a better working world for all.

The Opportunity

As part of EY’s Cybersecurity team, you will perform hands-on penetration testing and security assessments across a variety of environments, including web applications, networks, Active Directory, wireless environments, cloud platforms, and other enterprise technologies.

You will identify and exploit security vulnerabilities, analyze their potential impact, and develop detailed reports covering findings, exploitation techniques, associated risks, and recommended remediation.

We’re looking for an experienced Penetration Tester / Offensive Security professional who can independently execute complex security assessments while also providing technical guidance to junior team members.

Your Key Responsibilities

• Perform penetration testing across internet-facing and internal networks, web applications, wireless environments, and enterprise infrastructure.

• Execute Red Team and adversary simulation assessments to identify weaknesses in an organization’s security posture.

• Identify and exploit vulnerabilities across applications, networks, operating systems, and infrastructure.

• Perform Active Directory security assessments and attack simulations.

• Conduct in-depth analysis of penetration testing results and validate the exploitability and business impact of identified vulnerabilities.

• Create comprehensive technical reports covering findings, exploitation procedures, risks, and remediation recommendations.

• Communicate complex security findings to technical teams, business stakeholders, and executive audiences.

• Perform security testing based on OWASP Top 10 and established penetration testing methodologies.

• Support application security testing, including DAST, SAST, source code review, and Secure SDLC activities.

• Develop automation to improve penetration testing, security testing, and reporting processes.

• Support security assessments involving AWS, Microsoft Azure, GCP, Operational Technology (OT), and IoT environments, where applicable.

• Provide technical guidance and mentoring to junior team members on penetration testing engagements.

Skills and Attributes for Success

• Strong hands-on experience in penetration testing and offensive security.

• Strong understanding of OWASP Top 10 and common web application vulnerabilities.

• Experience assessing Active Directory and Windows environments.

• Strong understanding of TCP/IP, network security, and common attack vectors.

• Experience with internal and external network penetration testing.

• Knowledge of Windows, Linux, UNIX, and other major operating systems.

• Exposure to cloud penetration testing across AWS, Azure, or GCP.

• Exposure to OT/IoT and wireless penetration testing is an advantage.

• Understanding of application security testing and SAST/DAST.

• Ability to clearly communicate technical security findings to both technical and non-technical stakeholders.

• Strong technical writing skills, particularly for penetration testing reports and remediation recommendations.

To Qualify for the Role

• Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related discipline, or equivalent relevant experience.

• Minimum of 6 years of relevant penetration testing / offensive security experience.

• Hands-on experience across multiple penetration testing areas, such as:

  • Web applications

  • Internal and external networks

  • Active Directory

  • Wireless environments

  • Red Team assessments

  • Cloud environments

• At least one relevant certification such as:

  • OSCP

  • OSCE

  • OSEP

  • OSWE

  • CREST

  • CRTE

  • eCPPT/eCPTX

  • eWPTX

Ideally, You’ll Also Have

• CISSP, GPEN, or GWAPT certification.

• Red Team or adversary simulation experience.

• Experience with security automation and scripting.

• Project or engagement management experience.

• Experience working directly with clients and communicating findings to senior stakeholders.

What We Look For

We’re looking for someone who can go beyond automated vulnerability scanning and perform hands-on exploitation and penetration testing.

The ideal candidate can independently assess applications, networks, Active Directory, and other enterprise environments, demonstrate the real-world impact of identified vulnerabilities, and clearly communicate remediation recommendations to clients and technical teams.