Note: The job is a remote job and is open to candidates in USA. EY is a global leader in assurance, consulting, tax, strategy and transactions, and they are seeking an Offensive Security Analyst - Manager to strengthen their enterprise security capabilities. The role involves conducting adversarial testing, proactive threat hunting, and collaborating with teams to enhance security operations and incident response.
Responsibilities
- Perform research and analysis of attacker tactics, techniques, and procedures (TTPs), and emulate those attacks in a collaborative and controlled environment
- Conduct proactive threat hunting operations leveraging SIEM, EDR, threat intelligence, and other security telemetry sources to identify malicious activity and previously unknown threats
- Identify patterns consistent with sophisticated attacker methodologies, and report on security concerns as they are escalated or identified
- Evaluate, develop, and operationalize Artificial Intelligence (AI) and Machine Learning (ML) capabilities to enhance cyber defense operations, including threat detection, threat hunting, anomaly detection, adversary emulation, attack simulation, and security automation
- Analyze digital artifacts, forensic evidence, logs, malware samples, and system telemetry collected during adversarial testing, investigations, and threat hunting activities
- Communicate with system owners, custodians, and IT stakeholders to facilitate security testing activities, including obtaining access to systems, digital artifact collection, and remediation activities
- Develop and present technical findings, attack narratives, risk assessments, and remediation recommendations to both technical and non-technical stakeholders using written reports, presentations, and executive briefings
- Maintain, manage, improve, and update security testing processes, procedures, and protocol documentation
- Identify means to disrupt attacker actions, validate security detections and defensive controls, identify coverage gaps, and enhance defender response capabilities
Skills
- 6+ years of relevant experience in one or more of the following areas: Red Teaming, Purple Teaming, Offensive Security Operations, Exploit Development, Penetration Testing, Security Research, or similar roles
- Demonstrated understanding of common and advanced cyber-attack vectors, exploitation methodologies, and intrusion set tactics, techniques, and procedures (TTPs)
- Knowledge of incident response processes and the integration of red and purple team findings into defensive operations and remediation efforts
- Good understanding of Windows and Unix/Linux operating systems
- Understanding of IP networking concepts, including addressing, routing, common network protocols, and the use of proxies, load balancers, firewalls, routers, and switches within enterprise architectures
- Understanding of security concepts across on-premises, cloud, and hybrid enterprise environments
- Global mindset for working with different cultures and backgrounds
- Demonstrated integrity and judgment within a professional environment
- Ability to appropriately balance work/personal priorities
- Teaming skills as well as ability to work independently on tasks
- Good social, communication, and writing skills
- Associate's degree or equivalent professional experience, and/or one or more of the following certifications: OSCP, OSEP, CRTO, GXPN, CISSP, GPEN, GCIH, GCFE, CFCE, other relevant GIAC certs
- Familiarity with EDR, SIEM, and SOAR technologies, detection engineering, threat hunting methodologies, security testing, scripting, and malware analysis techniques
- Extensive experience in applied enterprise hacking techniques (red/purple-teaming) across on-premises, cloud, and hybrid environments
- Experience with adversary emulation frameworks, attack simulation platforms, and threat-informed defense methodologies
- Background in DevSecOps, with the ability to rapidly build and deploy test scenarios to validate cyber threats and security concerns
- Hands-on experience as an administrator configuring one or more of SIEM, SOAR, Endpoint Protection, Vulnerability Scanners, or Data Loss Prevention
- Proficient with one or more scripting languages such as Python, PowerShell, Perl, or similar languages in a threat intelligence, incident response, or cyber defense environment
- Experience evaluating emerging AI-enabled attack techniques and applying AI/ML technologies to enhance threat detection, adversary emulation, detection engineering, security automation, or cyber defense capability development
Benefits
- Medical and dental coverage
- Pension and 401(k) plans
- A wide range of paid time off options
- Hybrid model with expectation to work together in person 40-60% of the time
- Flexible vacation policy
- Time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being
- Reasonable accommodation to qualified individuals with disabilities including veterans with disabilities
Company Overview
Company H1B Sponsorship