Penetration Tester

A great opportunity for a mid-level Security Testing Consultant to join a London-based cybersecurity and AI risk consultancy operating to CREST methodology as an accredited CREST member company. You’ll own delivery of your own engagements end-to-end (scoping, testing, reporting and client debriefs) across web, infrastructure, application and cloud testing, with API, mobile and wireless work as the project mix demands.

If you want a role that takes reporting and client communication as seriously as the testing itself, with a clear runway into AI security and red teaming, this is well worth a conversation.

Why this role stands out:

• A genuine, structured growth path: over your first 18–24 months, progress from core testing into AI security assessments, assumed breach exercises and red team operations, backed by a funded personal development plan toward OSCP, OSWE, OSEP, CRTO, CREST CCT and emerging AI security tracks
• Real client-facing ownership: present findings to technical and executive audiences and provide post-test remediation guidance as standard
• A collaborative team with experienced senior testers and an in‑house methodology you can help shape, plus hybrid working with some UK client‑site travel

• Conduct penetration tests across web applications, infrastructure, cloud environments and APIs, with mobile and wireless engagements as required
• Produce clear, well-structured reports and present findings to technical and executive client audiences
• Provide post-test remediation guidance and follow‑up support
• Contribute to the evolution of the in‑house testing methodology and tooling
• Support development of more junior team members
• Stay current with offensive security research, techniques and emerging threats
• Around 3–5 years of hands‑on penetration testing experience
• Web application testing aligned to OWASP WSTG, with hands‑on Burp Suite work
• Infrastructure and network testing, including Active Directory
• Cloud security testing in at least one of AWS, Azure or GCP (familiarity with a second helpful)
• API testing, including REST and ideally GraphQL
• Confident use of standard offensive tooling: Kali, Burp Suite, Nmap, a recognised vulnerability scanner (Nessus, Qualys or equivalent), Metasploit
• Working understanding of common application, network and cloud security controls, and how they fail
• One or more current accreditations from CREST (CPSA, CRT), Offensive Security (OSCP, OSWE) or equivalent
• Confident written English, as reporting is a substantial part of the role
• No degree required; demonstrable experience, certifications, lab work and research contributions weighed on their own merits
• Hybrid working
• Benefits package

Useful but not required:

• Programming in any mainstream language
• Containerisation and CI/CD security
• Red team or social engineering exposure
• Hands‑on AI/LLM security testing
• Hardware/IoT/ICS security
• Bug bounty or responsible disclosure work
• Mobile (OWASP MASTG) and wireless testing familiarity
• Annual gainshare bonus when company performance is above targetFunded personal development plan including certifications and conference attendance

#PenetrationTesting #SecurityTesting #CREST #OSCP #RedTeam #AISecurity #CyberSecurity #LondonJobs #InfoSecJobs

#J-18808-Ljbffr…