Government and Public Sector - Cybersecurity - Penetration Tester - Senior Consultant

About the role

The opportunity is to join EY's Government and Public Sector practice as a Senior Consultant specializing in Penetration Testing. This role offers a chance to work on real-world challenges for federal, state, local, and educational clients, helping them implement new strategies to achieve their mission outcomes.

Responsibilities

• Execute advanced penetration testing and red team activities.
• Identify, validate, and exploit complex attack paths to demonstrate realistic business and mission risk.
• Correlate findings across network, application, cloud, and identity attack vectors to identify systemic security weaknesses.
• Escalate critical and high-risk findings to engagement leadership and client stakeholders during active testing activities.
• Articulate technical risk, potential impact, and exploitation context in clear, client-facing language suitable for both technical and executive audiences.
• Review, validate, and approve testing evidence and technical findings prior to inclusion in formal deliverables.
• Author and contribute to technical penetration testing reports and executive summaries that clearly describe risk, likelihood, and potential impact.
• Apply consistent evidence handling and documentation practices aligned to engagement and compliance requirements.
• Support engagement scoping, testing strategy development, and definition of rules of engagement.
• Provide technical oversight and mentoring to staff-level penetration testers during testing execution and report development.
• Serve as a senior technical authority during client briefings, readouts, and debrief sessions.

Requirements

• Perform penetration testing which includes internet, intranet, wireless, web application, social engineering and physical penetration testing.
• Execute red team scenarios to highlight gaps impacting organizations' security postures.
• Work both independently as well as lead a team of technical testers on penetration testing and red team engagements.
• Provide technical leadership and advise junior team members on attack and penetration test engagements.
• Identify and exploit security vulnerabilities in a wide array of systems in a variety of situations.
• Perform in-depth analysis of penetration testing results and create reports that describe findings, exploitation procedures, risks and recommendations.
• Execute penetration testing projects using the established methodology, tools and rules of engagements.
• Convey complex technical security concepts to technical and non-technical audiences including executives.
• Obtain/maintain a secret level clearance.
• Be comfortable working in-person as needed in the greater Washington, DC area.
• Have a Bachelor’s Degree with minimum of three years of direct penetration testing or red teaming experience supporting enterprise or large-scale environments.
• Have at least one intermediate or advanced offensive security certification, such as: Offensive Security Certified Professional (OSCP), GIAC Penetration Tester (GPEN), etc.
• Have demonstrated hands-on execution of penetration testing across infrastructure, application, cloud, and identity-centric environments.
• Have at least 1,000 hours of penetration testing activities, aligned with EY Attack and Penetration Testing senior capability benchmarks.
• Have technical skills in network, operating system, and application exploitation techniques, credential-based attack techniques, Active Directory and enterprise identity infrastructure assessment, web application and API security testing, cloud and hybrid environment penetration testing, and use of commercial, open-source, and custom penetration testing tools.

Qualifications

• Experience in penetration testing which includes internet, intranet, web application penetration tests, wireless, social engineering, and red team assessments.
• Operates effectively within multi-role delivery teams that include Managers, Seniors, and Staff testers aligned to EY GPS resource structures.
• Demonstrated professionalism and discretion when handling sensitive government systems, data, and assessment findings.
• Strong client-facing communication skills suitable for interaction with security leadership, compliance personnel, and oversight stakeholders.

Skills and Attributes

• Perform penetration testing which includes internet, intranet, web application penetration tests, wireless, social engineering, and red team assessments.
• Execute red team scenarios to highlight gaps impacting organizations' security postures.
• Work both independently as well as lead a team of technical testers on penetration testing and red team engagements.
• Provide technical leadership and advise junior team members on attack and penetration test engagements.
• Identify and exploit security vulnerabilities in a wide array of systems in a variety of situations.
• Perform in-depth analysis of penetration testing results and create reports that describe findings, exploitation procedures, risks and recommendations.
• Execute penetration testing projects using the established methodology, tools and rules of engagements.
• Convey complex technical security concepts to technical and non-technical audiences including executives.
• Obtain/maintain a secret level clearance.
• Be comfortable working in-person as needed in the greater Washington, DC area.
• Have a Bachelor’s Degree with minimum of three years of direct penetration testing or red teaming experience supporting enterprise or large-scale environments.
• Have at least one intermediate or advanced offensive security certification, such as: Offensive Security Certified Professional (OSCP), GIAC Penetration Tester (GPEN), etc.
• Have demonstrated hands-on execution of penetration testing across infrastructure, application, cloud, and identity-centric environments.
• Have at least 1,000 hours of penetration testing activities, aligned with EY Attack and Penetration Testing senior capability benchmarks.
• Have technical skills in network, operating system, and application exploitation techniques, credential-based attack techniques, Active Directory and enterprise identity infrastructure assessment, web application and API security testing, cloud and hybrid environment penetration testing, and use of commercial, open-source, and custom penetration testing tools.
• Operate effectively within multi-role delivery teams that include Managers, Seniors, and Staff testers aligned to EY GPS resource structures.
• Demonstrate professionalism and discretion when handling sensitive government systems, data, and assessment findings.
• Have strong client-facing communication skills suitable for interaction with security leadership, compliance personnel, and oversight stakeholders.

Benefits

Our comprehensive benefits package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options. Join us in our team-led and leader-enabled hybrid model, where most people in external, client-serving roles work together in person 40-60% of the time over the course of an engagement, project, or year. You'll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.

Pay

The base salary range for this role in all geographic locations in the US is $104,800 to $192,200. The base salary range for New York City Metro Area, Washington State and California (excluding Sacramento) is $125,800 to $218,500. Individual salaries within those ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography.

Schedule

Individuals assigned to projects within the Government and Public Sector practice may be required to work at client, EY, and/or contractor sites. Our goal is to assign professionals to projects within a commutable distance of their work location office. In certain circumstances, travel may be required beyond their work location based on client and project needs. Candidates should be willing to travel 20 – 30% or more.

Equal Opportunity Employer

EY is committed to providing reasonable accommodation to qualified individuals with disabilities and encourages applicants with disabilities to apply. For those living in California, please click here for additional information. EY is an Equal Employment Opportunity and Affirmative Action employer. We focus on high-ethical standards and integrity among our employees and expect all candidates to demonstrate these qualities. EY is committed to providing reasonable accommodation to qualified individuals with disabilities and encourages applicants with disabilities to apply.