Note: The job is a remote job and is open to candidates in USA. EY is a globally connected professional services organization that uses technology, data, and AI to help clients and build a better working world. The Active Defense Analyst Manager will conduct offensive security testing, adversary emulation, threat-informed defense, and attack simulations to validate security controls and improve defensive capabilities. The role will also communicate findings, develop remediation recommendations, maintain testing processes, and mentor junior associates.
Responsibilities
- Conduct attack simulations against Windows or Linux Operating systems leveraging advanced cyber-attack vectors, exploitation methodologies, and intrusion set tactics, techniques, and procedures (TTPs)
- Research and identify patterns consistent with sophisticated attacker methodologies, and report on security concerns as they are escalated or identified
- Experience with security concepts across on-premises, cloud, and hybrid enterprise environments
- Evaluate, develop, and operationalize Artificial Intelligence (AI) capabilities to enhance adversary emulation, attack simulation, and security automation
- Communicate with system owners, custodians, and IT stakeholders to facilitate security testing activities, including obtaining access to systems, digital artifact collection, and remediation activities
- Develop and present technical findings, attack narratives, risk assessments, and remediation recommendations to both technical and non-technical stakeholders using written reports, presentations, and executive briefings
- Maintain, manage, improve, and update security testing processes, procedures, and protocol documentation
- Identify means to disrupt attacker actions, validate security detections and defensive controls, identify coverage gaps, and enhance defender response capabilities
- The role requires mentoring, collaboration, and training of more junior associates
- On rare occasions, may be required to work nights or weekends in support of incident response or penetration audits
Skills
- Experience with security concepts across on-premises, cloud, and hybrid enterprise environments
- 6+ years of relevant experience in one or more of the following areas: Red Teaming, Purple Teaming, Offensive Security Operations, Exploit Development, Penetration Testing, Security Research, or similar roles
- Proven hands-on experience with EDR evasion
- Proficient with two or more programming languages such as C, C++, C# or Python
- Experience with command-and-control channel frameworks, data obfuscation/encryption, and Active Directory exploitation
- Bachelor's or Master's Degree in Computer Science, Information Systems, Engineering, a related field, or equivalent experience, and/or one or more of the following certifications: OSCP, OSEP, CRTO, GXPN, GPEN, GCIH, other relevant GIAC certs
- The role requires mentoring, collaboration, and training of more junior associates
- On rare occasions, may be required to work nights or weekends in support of incident response or penetration audits
- Extensive experience in applied enterprise hacking techniques (red/purple-teaming) across on-premises, cloud, and hybrid environments
- Experience with adversary emulation frameworks, attack simulation platforms, and threat-informed defense methodologies
- Background in DevSecOps, with the ability to rapidly build and deploy test scenarios to validate cyber threats and security concerns
Benefits
- Medical and dental coverage
- Pension and 401(k) plans
- A wide range of paid time off options
- A team-led and leader-enabled hybrid model
- Flexible vacation policy
- Time off for designated EY Paid Holidays
- Winter/Summer breaks
- Personal/Family Care leave
- Other leaves of absence when needed to support physical, financial, and emotional well-being
Company Overview
Company H1B Sponsorship