<div style="font-family:Arial;font-size:1.0em"> At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. </div> <div style="font-family:Arial;font-size:1.0em"> </div>Digital Risk- Application & Offensive Security – Senior Job purpose: Senior in the Risk Advisory team to work on Application Security and Offensive Security engagements for our customers across the globe. You will be responsible for delivering secure application and adversarial testing engagements in accordance with EY quality guidelines & methodologies. You will be expected to execute and coordinate engagement activities on a day-to-day basis and proactively support the identification of new opportunities in application and offensive security domains. You will work closely with development, DevOps, and security teams to embed secure-by-design practices and validate application security through real-world attack simulations using a Glasswing-aligned adversarial approach. You will assist in developing new methodologies, strengthen secure engineering practices, and contribute to creating a strong learning culture by mentoring junior team members. In line with EY’s commitment to quality, you will confirm that work is of the highest quality by reviewing outputs from junior members. Your client responsibilities: <ul> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Perform Secure SDLC reviews and provide actionable recommendations across application environments</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Conduct and support bug bounty programs and vulnerability validation activities</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Execute adversarial testing and attack simulation exercises using real-world attack scenarios (Glasswing-aligned approach)</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Identify exploitable vulnerabilities and validate them from an attacker’s perspective</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Support threat modeling and secure architecture reviews for applications</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Maintain relationships with client stakeholders across development, DevOps, and security teams</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Demonstrate understanding of modern application architectures (APIs, microservices, cloud-native systems)</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Support secure design and DevSecOps integration across the application lifecycle</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Assist Managers in business development, proposal creation, and solutioning</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Contribute to development of methodologies, frameworks, and thought leadership</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Facilitate knowledge sharing sessions and discussions with client teams</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Provide regular status updates on engagements and deliverables</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Stay updated on emerging application security threats, vulnerabilities, and attack techniques</li> </ul> Your people responsibilities: <ul> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Work collaboratively with team members to deliver high-quality outputs within timelines</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Mentor and train junior resources on secure coding, testing, and adversarial thinking</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Drive adherence to quality standards and methodologies</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Participate in internal capability development and knowledge sharing initiatives</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Support performance management of team members</li> </ul> Mandatory skills: <ul> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Strong understanding of Secure SDLC and DevSecOps practices</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Experience in application security testing (SAST, DAST, API testing, manual testing)</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Strong knowledge of OWASP Top 10 and web application vulnerabilities</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Experience in bug bounty programs and vulnerability validation</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Understanding of adversarial testing and attack simulation approaches (Glasswing-aligned)</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Knowledge of API security (OAuth2, OIDC, mTLS)</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Experience in threat modeling techniques</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Familiarity with modern application architectures (cloud, microservices, containers)</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Strong understanding of web protocols and technologies</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Knowledge of CI/CD pipelines and secure engineering practices</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Certifications such as CEH, OSCP, GWAPT or equivalent preferred</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">BE/BTech/MCA with 4–8 years of relevant experience</li> </ul> Preferred skills: <ul> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Exposure to cloud security (AWS/Azure/GCP)</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Experience working in Agile/DevOps environments</li> <li style="font-family:arial, helvetica, sans-serif;font-size:10.0pt">Prior client-facing or consulting experience</li> </ul> <div style="font-family:Arial;font-size:1.0em"> EY | Building a better working world EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets. Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow. EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories. </div>

FS-RISK CONSULTING-TPRM-Senior-Application and Offensive Security (Bengaluru, KA, IN, 560016) @ EY Global Services

About this role

Ready to apply?