At EY, we’re all in to shape your future with confidence.We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.Join EY and help to build a better working world.EY – Cyber Security – Manager – Offensive Security Job Listing DetailAt EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture, and technology to become the best version of you. We’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.The OpportunityWe’re looking for a Manager in our Cyber Security team with a strong focus on Offensive Security, Red Teaming, Cloud‑native VAPT, and DevSecOps security assurance. Exposure to AI, ML, and GenAI security assessments is considered a desirable and good‑to‑have capability, as organizations increasingly adopt AI‑enabled technologies.As part of our Cyber Technology Consulting practice, you will play a key role in leading and delivering offensive security services to clients across the MENA region. You will work with leading organizations across sectors including Financial Services, Government & Public Sector, Energy, Telecom, Healthcare, and Digital-native enterprises, helping them proactively identify vulnerabilities, simulate advanced adversaries, and strengthen their cyber resilience.This role offers a unique opportunity to operate at the intersection of deep technical expertise, strategic advisory, and large-scale transformation, while contributing to the growth of our Offensive Security competency.Your Key ResponsibilitiesClient Delivery And Engagement ManagementLead and deliver end-to-end offensive security engagements, including:Network and infrastructure penetration testingWeb and mobile application security testingAPI security assessments (REST, SOAP, GraphQL, microservices)Cloud security testing across AWS, Azure, and GCPPlan and execute red team / adversary simulation / assumed breach exercises, emulating real-world threat actors to test organizational detection and response capabilities.Execute and oversee purple teaming engagements, enabling alignment between offensive findings and defensive improvements (SOC, detection engineering, incident response).Conduct and lead cloud offensive security assessments and validate effectiveness of controls across all layers and workloads within AWS, Azure, and GCP, including IAM, network, storage, container, serverless, and DevSecOps pipeline components.Assess cloud misconfigurations, identity abuse paths, privilege escalation scenarios, insecure pipeline configurations, exposed secrets, and lateral movement techniques across hybrid and cloud native environments.Perform penetration testing and security assessments of cloud native architectures, APIs, microservices, Kubernetes, infrastructure as code, container images, and CI/CD pipelines to identify weaknesses across the secure software delivery lifecycle.Assess and validate CSPM / CNAPP controls,



identifying configuration gaps, privilege escalation paths, and exposure risks in cloud-native environments.Deliver AI/GenAI security assessments, including (Desirable / Good‑to‑Have):Prompt injection and adversarial input risksModel misuse and abuse scenariosData leakage and insecure integration risksAI governance and secure deployment considerationsTranslate technical vulnerabilities into business risk insights, including attack paths, impact analysis, and prioritized remediation strategies.Stakeholder Engagement And AdvisoryServe as a trusted advisor to CISOs, CIOs, security leaders, and engineering teams, articulating security risks in a business-relevant and outcome-driven manner.Present complex offensive security findings to both technical and executive audiences, tailoring messaging appropriately.Support clients in developing offensive security roadmaps, maturity models, and remediation programs aligned to leading practices.Practice And Capability DevelopmentContribute to building the Offensive Security practice, including:Development of methodologies, testing playbooks, and acceleratorsCreation of reusable assets and frameworksStandardization of delivery approaches and quality benchmarksSupport go-to-market initiatives, thought leadership, and client pursuits:RFP/RFI responsesSolution positioning and capability presentationsMarket-facing content development (whitepapers, POVs)Stay ahead of evolving threat landscape, including:Advanced attacker techniques and exploit trendsAPI and cloud-native attack vectorsAI/ML security risks and emerging vulnerabilitiesPeople Leadership And Team DevelopmentManage and mentor a team of consultants and senior consultants, fostering:Deep technical capability in offensive security domainsHigh-quality delivery and reporting standardsContinuous learning and certification progressionProvide performance feedback, coaching, and career guidance aligned with firm values.Build a collaborative, high-performance culture within the Offensive Security team.Skills and Attributes for SuccessStrong hands-on expertise in offensive security methodologies, including penetration testing, exploit development, adversary simulation, and attack path analysis.Deep understanding of:OWASP Top 10 and API Security Top 10Authentication and authorization mechanisms (OAuth, JWT, SSO, etc.)Business logic vulnerabilities and modern application architecturesProven experience in API security testing and microservices environments.Strong working knowledge of cloud security risks, including:Misconfigurations, IAM weaknesses, secrets exposure, lateral movementCloud-native architectures and shared responsibility modelFamiliarity with CSPM, CNAPP,



and CIEM concepts and their practical implementation.Awareness of AI security risks, including adversarial attack techniques, prompt injection, and model governance concerns.Strong analytical and problem-solving ability with attention to detail.Ability to convert complex technical findings into explicit, risk-based narratives.Excellent communication, stakeholder management, and consulting skills.Proven ability to manage multiple engagements in parallel with strong quality and delivery discipline.To Qualify for the Role, You Must HaveA bachelor’s or master’s degree in cyber security, Information Technology, Computer Science, or related discipline.10–14 years of experience in Cyber Security, with strong focus on Offensive Security and advanced VAPT.Strong knowledge of OWASP Top 10, OWASP API Security, SANS Top 25, and MITRE ATT&CK.Hands-on; experience delivering:VAPT engagements across network, application, API, and cloud layersRed team / adversary simulation exercisesCloud security assessmentsProven experience delivering Red Team, Cloud native penetration testing, and DevSecOps security validation engagements across modern engineering environments.Hands on experience testing AWS, Azure, or GCP environments, modern application stacks, CI/CD platforms, containerized workloads, and infrastructure as code implementations.Experience working in a consulting or professional services environment, managing clients and engagements.Strong reporting, documentation, and presentation skills.Proven ability to work in global and cross-cultural environments.Willingness and flexibility to travel across the MENA region, as required.Relevant certifications such as OSCP, OSEP, OSCE, CRTO, GWAPT, GPEN, or equivalent.Experience in:Advanced red teaming and purple teaming engagementsAPI security and cloud offensive securityAI/LLM application security testingDevSecOps and CI/CD pipeline securityContainer and Kubernetes securityExposure to:BAS tools and attack simulation platformsEDR/XDR validation and detection engineeringRegulatory and industry frameworks relevant to MENAWhat We Look ForWe are looking for individuals who bring:A growth mindset and passion for offensive securityThe ability to balance deep technical expertise with business acumenStrong client-centricity and relationship-building capabilityA collaborative approach to problem-solving and innovationA commitment to quality, integrity, and continuous improvementEY | Building a better working world EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.

📌 Ey-Cyber Security-Offensive Security-Manager (Kochi)
🏢 EY
📍 Kochi