Cybersecurity Penetration Tester

EY is seeking a Government and Infrastructure Service Delivery Center Penetration Tester to plan and execute advanced penetration testing and red team activities. The role focuses on identifying and validating exploitable vulnerabilities, producing clear technical risk reporting for client and leadership audiences, and supporting delivery of high-quality testing evidence.

Location and Work Model

• San Antonio, TX (onsite)
• Office presence: work in the local office 3 days per week
• Travel: 20 – 30% or more
• Other locations: Anywhere in Region

Requisition ID: 1759834
Date: Nov 10, 2026

Compensation

• Base salary range (yearly): USD 92,900 - 153,900
• Additional range details vary by office location, including:
  • NYC, Boston, Washington DC Metro, Washington State, and Southern California offices: $92,900 to $153,900
  • Bay Area, CA offices: $96,000 to $160,500
  • All other US offices (including Sacramento): $77,500 to $140,900
• Individual salary determination: based on education, experience, knowledge, skills, and geography

Key Responsibilities

• Execute advanced penetration testing and red team activities.
• Identify, validate, and exploit complex attack paths to demonstrate realistic business and mission risk.
• Perform manual validation of vulnerabilities identified via automated or tool-based scanning to confirm exploitability and impact.
• Correlate findings across network, application, cloud, and identity attack vectors to identify systemic security weaknesses.
• Escalate critical and high-risk findings to engagement leadership and client stakeholders during active testing.
• Translate technical risk, potential impact, and exploitation context into client-facing language for both technical and executive audiences.
• Review, validate, and approve testing evidence and technical findings prior to inclusion in formal deliverables.
• Author and contribute to penetration testing reports and executive summaries describing risk, likelihood, and potential impact.
• Apply evidence handling and documentation practices aligned to engagement and compliance requirements.
• Support engagement scoping, testing strategy development, and definition of rules of engagement.
• Provide technical oversight and mentoring to staff-level penetration testers during testing and report development.
• Act as a senior technical authority during client briefings, readouts, and debrief sessions.
• Research and discover emerging security vulnerabilities, attend and speak at top security conferences worldwide, and share knowledge with key industry groups.

Required Qualifications

• Bachelor’s Degree
• 3+ years of direct penetration testing or red teaming experience supporting enterprise or large-scale environments
• Hands-on execution of penetration testing across infrastructure, application, cloud, and identity-centric environments
• Ability to obtain and maintain a Secret level clearance
• At least one intermediate or advanced offensive security certification, such as:
  • Offensive Security Certified Professional (OSCP)
  • GIAC Penetration Tester (GPEN)
  • Equivalent industry-recognized certification
• Demonstrated experience completing approximately 1,000 hours of penetration testing aligned with EY Attack and Penetration Testing senior capability benchmarks

Additional Skills and Experience

• Network, operating system, and application exploitation techniques
• Credential-based attack techniques including password cracking, pass-the-hash, and token abuse
• Active Directory and enterprise identity infrastructure assessment
• Web application and application programming interface (API) security testing
• Cloud and hybrid environment penetration testing using commercial, open-source, and custom penetration testing tools

Services Delivery Center Overview

The Service Delivery Center includes high-performing, US-based resources delivering project-based work and managed services to federal clients. The team collaborates to plan, pursue, deliver, and manage engagements to assess, improve, build, and, when applicable, operate integrated security operations. EY supports career-long training and coaching to develop skills.

Education and Skills for Success

• Perform penetration testing across internet, intranet, wireless, web application, social engineering, and physical penetration testing
• Execute red team scenarios to highlight gaps affecting organizational security posture
• Work independently and lead technical testers on penetration testing and red team engagements
• Advise junior team members on attack and penetration testing engagements
• Perform in-depth analysis of results and create reports that describe findings, exploitation procedures, risks, and recommendations
• Execute projects using established methodology, tools, and rules of engagement
• Convey complex technical security concepts to both technical and non-technical audiences, including executives

Benefits

• Comprehensive compensation and benefits package
• Base salary range varies by location
• Medical and dental coverage
• Pension and 401(k) plans
• Paid time off options
• Flexible vacation policy
• Time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence

Employment Application Information

• Limit applications to two within a six-month period to optimize application experience
• EY accepts applications for this position on an ongoing basis

Work Location and Travel Requirements

Due to the nature of EY Government and Infrastructure work, assignments may require completion at client, EY, and/or CON environments. EY’s goal is to assign professionals to projects within a commutable distance of their office, with travel potentially required beyond the work location based on client and project needs.