Cyber Security Penetration Tester

Overview

In this role you perform hands-on security testing of client web apps, APIs and infrastructure within a collaborative team. You identify vulnerabilities, demonstrate impact and provide practical remediation guidance. You will develop your technical skills through mentoring, testing across engagements, and pursuing industry certifications. This opportunity suits an early-career tester looking to broaden expertise while contributing to secure client outcomes.

Pay / Benefits

• hybrid work (UK, 1x in office)
• funded certification pathway
• training and lab time
• opportunities for tooling and methodology contributions
• professional development support

Responsibilities

• Conduct manual and tool-assisted testing of web applications, APIs and internal/external infrastructure.
• Identify, validate and safely exploit vulnerabilities within scope, including authentication, authorization, injection, and misconfigurations.
• Map attack paths, assess privilege escalation risks and explain business impact.
• Follow established methodologies (OWASP, WSTG, API Top 10, PTES, CHECK/CREST).
• Prepare engagements by confirming scope and prerequisites with the lead.
• Produce clear reports with evidence, risk ratings and prioritized remediation guidance.
• Support remediation and perform retests to verify fixes.
• Escalate critical findings to the engagement lead and articulate impact to stakeholders.
• Share knowledge through peer reviews, tooling improvements and technical write-ups.

Key requirements

• 1–2 years’ commercial penetration testing experience across web apps, APIs and infrastructure
• Good working knowledge of common web and API vulnerabilities (OWASP Top 10, API Top 10)
• Practical experience with Burp Suite, Nmap and Metasploit
• Ability to validate findings, rule out false positives and gather reproducible evidence
• Clear technical writing that communicates risk and remediation clearly

• Strong communication
• Collaboration and teamwork
• Problem-solving and analytical thinking
• Burp Suite
• Nmap
• Metasploit

…