Senior Consultant - Penetration Tester

EY is hiring a Senior Consultant - Penetration Tester to support cybersecurity efforts within its Government & Public Sector practice. In this onsite role in McLean, VA, you will help deliver penetration testing and red team activities that validate real-world risk across complex enterprise environments.

The position focuses on executing advanced offensive testing, correlating results across multiple technology domains, and communicating findings in a way that works for both technical teams and executive stakeholders.

Role Summary

As a senior technical authority, you will execute and validate penetration testing and red team activities, identify and confirm exploitable attack paths, report risk with clear context, and provide oversight during testing execution and reporting.

Key Responsibilities

• Execute advanced penetration testing and red team activities.
• Identify, validate, and exploit complex attack paths to demonstrate realistic business and mission risk.
• Perform manual validation of vulnerabilities found through automated or tool-based scanning to confirm exploitability and impact.
• Correlate findings across network, application, cloud, and identity attack vectors to identify systemic weaknesses.
• Escalate critical and high-risk findings to engagement leadership and client stakeholders during active testing.
• Articulate technical risk, potential impact, and exploitation context in clear language for technical and executive audiences.
• Review, validate, and approve testing evidence and technical findings prior to inclusion in formal deliverables.
• Author and contribute to technical penetration testing reports and executive summaries describing risk, likelihood, and potential impact.
• Apply consistent evidence handling and documentation practices aligned to engagement and compliance requirements.
• Support engagement scoping, testing strategy development, and definition of rules of engagement.
• Provide technical oversight and mentoring to staff-level penetration testers during testing execution and report development.
• Serve as a senior technical authority during client briefings, readouts, and debrief sessions.

Minimum Requirements

• Bachelor’s Degree.
• 3+ years of direct penetration testing or red teaming experience supporting enterprise or large-scale environments.
• Ability to obtain and maintain a secret level clearance.
• Comfort working in-person as needed in the Washington, DC area.
• Hands-on penetration testing experience across infrastructure, application, cloud, and identity-centric environments.
• At least one intermediate or advanced offensive security certification, such as OSCP, GPEN, or an equivalent industry-recognized certification.
• Demonstrated experience completing approximately 1,000 hours of penetration testing aligned with EY Attack and Penetration Testing senior capability benchmarks.
• Network, operating system, and application exploitation techniques.
• Credential-based attack techniques including password cracking, pass-the-hash, and token abuse.
• Active Directory and enterprise identity infrastructure assessment.
• Web application and API security testing.
• Cloud and hybrid environment penetration testing using commercial, open-source, and custom penetration testing tools.

Benefits

• Comprehensive compensation and benefits package rewarded based on performance and business value.
• Base salary range listed for various offices/areas.
• Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and paid time off options.
• Flexible vacation policy to decide how much vacation time you need.
• Time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed.

Compensation

• USD 104,800 - 209,700 per year
• Competitive salary (as listed)

Additional Information

• Location: McLean
• Requisition ID: 1760668
• Date: Nov 12, 2026
• Work may be required to be completed at client, EY, and/or CON facilities due to the Government and Public Sector nature of the work.
• Travel may be required (listed as 20%–30% or more).
• Projects could include penetration testing and simulating physical breaches to identify vulnerabilities.

Preferred (Ideally You’ll Also Have)

• Penetration testing experience including internet, intranet, web application penetration tests, wireless, social engineering, and red team assessments.
• Ability to operate effectively within multi-role delivery teams including Managers, Seniors, and Staff testers aligned to EY GPS resource structures.
• Demonstrated professionalism and discretion when handling sensitive government systems, data, and assessment findings.
• Strong client-facing communication skills for interaction with security leadership, compliance personnel, and oversight stakeholders.