Senior Consultant - Tech Consulting - Cybersecurity Ernst & Young AE

Conduct penetration testing across web, mobile, APIs, cloud, and network environments (internal and external).

• Execute red team and purple team operations, including social engineering, OSINT, and physical security assessments.
• Perform secure code reviews, wireless security assessments, and application security consulting when required.
• Develop and execute adversarial attack simulations, leveraging C2 frameworks (commercial: Cobalt Strike, Brute Ratel, NightHawk; open source: Havoc, Mythic, Sliver, Merlin).
• Stay updated with emerging cyber threats, vulnerabilities, and offensive security techniques, and incorporate these insights into client engagements.
• Develop detailed reports, articulate technical findings, and deliver actionable recommendations to both technical teams and executive stakeholders.
• Support pre-sales activities such as scoping, proposal writing, and client workshops.

Skills and attributes for success

• Collaborating with other members of the engagement team to plan the engagement and develop work program timelines, risk assessments and other documents/templates.
• Ability to interpret complex technical results and present insights to business stakeholders.
• Strong analytical, problem-solving, and critical-thinking skills.
• Excellent communication and collaboration skills.
• Deep technical understanding of offensive security methodologies, including network penetration testing, web application testing, and adversary simulation.

To qualify for the role, you must have

• Bachelor s degree in computer science, Cybersecurity, or related field.
• 4 6 years of hands-on experience in penetration testing, red teaming, or exploit development.
• Demonstrable proficiency in at least two of the following methodologies:

• Web, web services, mobile, or thick client penetration testing.
• Internal/external network penetration testing.
• Secure code review & application security consulting.
• Wireless assessments.
• Social engineering and red team assessments.

• Strong technical understanding in at least two of the following domains:

• Common web technologies and frameworks.
• Application architecture.
• Cloud platforms (AWS, Azure, GCP).
• Networking and network protocols.
• DevOps pipelines and CI/CD security.

• Hands-on expertise with offensive tools and frameworks (e.g., Burp Suite, Metasploit, BloodHound, Cobalt Strike, Sliver, Havoc).
• Strong knowledge of MITRE ATT&CK, OWASP Top 10, NIST SP PHONE_NUMBER, and red team methodologies.
• A valid passport for travel.
• Excellent communication skills with a consulting mindset.

Ideally, you ll also have

• Relevant Cyber and offensive security certifications

• Relevant certifications such as OSCP, OSCE, OSWE, OSEP, OSEE, GXPN, CRTO, SANS GWAPT, GPEN.

• Strong understanding of security frameworks and methodologies (e.g., MITRE ATT&CK, OWASP, NIST).
• Experience in offensive security engagements