Cyber Security Penetration Testing Consultant

Overview

As a Penetration Tester, you will perform hands-on security testing of client web apps, APIs and infrastructure. You’ll work within a collaborative testing team, guided by senior testers and CHECK Team Leaders on complex engagements. You’ll identify and validate vulnerabilities, demonstrate real-world impact, and provide practical remediation guidance. The role supports your growth toward CHECK and/or Red Team assessments, with mentoring and a clear path for certification progression.

Responsibilities

• Perform manual and tool-assisted testing of web applications, APIs and internal/external infrastructure
• Identify, validate and safely exploit vulnerabilities within rules of engagement (auth, authorization, injection, business logic, misconfigurations)
• Map attack paths, including privilege escalation, and explain business impact
• Follow recognised methodologies (OWASP WSTG, API Security Top 10, PTES, CHECK/CREST)
• Prepare for engagements by confirming scope, access and prerequisites with the engagement lead
• Write clear, reproducible reports with evidence, risk ratings and remediation priorities
• Support client remediation and perform retests to verify fixes
• Escalate critical findings to engagement lead and explain impact to stakeholders
• Share knowledge through peer review, tooling improvements and technical write-ups
• Contribute to internal tooling, methodology and innovation projects

Key requirements

• Typically 2–4 years’ commercial penetration testing experience across web apps, APIs and infrastructure
• Practitioner-level certification such as CREST CRT, Cyber Scheme CSTM, OSCP (holding or working towards)
• Knowledge of common web and API vulnerabilities (OWASP Top 10, API Security Top 10)
• Understanding of networking, protocols, and Windows/Linux security
• Experience with Burp Suite, Nmap and Metasploit
• Ability to validate findings, rule out false positives and capture reproducible evidence
• Clear technical writing that explains risk and remediation in plain language

• curiosity and problem-solving mindset
• clear communication and ability to explain complex risks to stakeholders
• team collaboration and willingness to share knowledge
• Burp Suite
• Nmap
• Metasploit

…