Penetration Tester

London | Hybrid | Permanent | Competitive Salary + Bonus

I’m working with a growing cybersecurity business in London that’s looking to add a Security Testing Consultant to its team.

This is a good one for someone who already has a few years of penetration testing experience under their belt and wants to keep progressing technically.

The work is varied. You’ll be testing across web applications, infrastructure, cloud environments and APIs, rather than being boxed into one particular area. There’ll also be opportunities to get involved in things like mobile, wireless, red teaming and newer areas of security as you develop.

What you’ll be doing

* Penetration testing across web apps, infrastructure, cloud and APIs

* Working with Active Directory and network environments

* Testing across AWS, Azure and/or GCP

* Using tools such as Burp Suite, Kali Linux, Nmap, vulnerability scanners and Metasploit

* Taking ownership of your own testing engagements

* Writing clear reports and talking clients through your findings

* Helping clients understand how vulnerabilities can actually be remediated

* Contributing ideas around testing approaches, tooling and methodology

* Sharing knowledge with other members of the team

What I’m looking for:

You’ll ideally have around 3–5 years of hands-on penetration testing experience.

You don’t need to tick every box, but experience across a good mix of the below would be ideal:

* Web application penetration testing

* OWASP / Burp Suite

* Infrastructure and network testing

* Cloud security testing

* API testing

* Kali Linux

If you’ve got certifications such as CREST CPSA / CRT, OSCP, OSWE or something similar, even better.

There’s no degree requirement for this role. They’re much more interested in what you can actually do technically and the experience you’ve built up.

Not essential, but any exposure to the following would be a bonus:

* CI/CD security

* Red teaming

* Social engineering

* AI / LLM security

* Mobile security

* IoT / hardware security

* Bug bounty or responsible disclosure work

Why it’s worth considering : The main attraction here is the progression.

They’re happy to invest in people technically, including funded certifications, training and conference attendance, and there’s scope to move into more advanced areas of offensive security as you grow.

That could include:

* Red team engagements

* Assumed breach testing

* AI security

* More advanced application and infrastructure testing

You’ll still be hands-on day to day, but you’re joining somewhere that gives you room to develop rather than just putting more and more standard penetration tests in your diary.

If you’re a penetration tester in or around London and fancy hearing a bit more about it, drop me a message