Penetration Tester

🚀 Security Testing Consultant | £50,000 – £60,000 | Hybrid – London

A great opportunity for a mid-level Security Testing Consultant to join a London-based cybersecurity and AI risk consultancy operating to CREST methodology as an accredited CREST member company. You'll own delivery of your own engagements end-to-end (scoping, testing, reporting and client debriefs) across web, infrastructure, application and cloud testing, with API, mobile and wireless work as the project mix demands.

If you want a role that takes reporting and client communication as seriously as the testing itself, with a clear runway into AI security and red teaming, this is well worth a conversation.

✨ Why this role stands out:

1️⃣ A genuine, structured growth path: over your first 18–24 months, progress from core testing into AI security assessments, assumed breach exercises and red team operations, backed by a funded personal development plan toward OSCP, OSWE, OSEP, CRTO, CREST CCT and emerging AI security tracks

2️⃣ Real client-facing ownership: present findings to technical and executive audiences and provide post-test remediation guidance as standard

3️⃣ A collaborative team with experienced senior testers and an in-house methodology you can help shape, plus hybrid working with some UK client-site travel

🎯 Responsibilities:

🔹 Conduct penetration tests across web applications, infrastructure, cloud environments and APIs, with mobile and wireless engagements as required

🔹 Produce clear, well-structured reports and present findings to technical and executive client audiences

🔹 Provide post-test remediation guidance and follow-up support

🔹 Contribute to the evolution of the in-house testing methodology and tooling

🔹 Support development of more junior team members

🔹 Stay current with offensive security research, techniques and emerging threats

🛠️ Skills/Must Have:

🔹 Around 3–5 years of hands-on penetration testing experience

🔹 Web application testing aligned to OWASP WSTG, with hands-on Burp Suite work

🔹 Infrastructure and network testing, including Active Directory

🔹 Cloud security testing in at least one of AWS, Azure or GCP (familiarity with a second helpful)

🔹 API testing, including REST and ideally GraphQL

🔹 Confident use of standard offensive tooling: Kali, Burp Suite, Nmap, a recognised vulnerability scanner (Nessus, Qualys or equivalent), Metasploit

🔹 Working understanding of common application, network and cloud security controls, and how they fail

🔹 One or more current accreditations from CREST (CPSA, CRT), Offensive Security (OSCP, OSWE) or equivalent

🔹 Confident written English, as reporting is a substantial part of the role

🔹 No degree required; demonstrable experience, certifications, lab work and research contributions weighed on their own merits

⭐ Useful but not required:

🔹 Programming in any mainstream language

🔹 Containerisation and CI/CD security

🔹 Red team or social engineering exposure

🔹 Hands-on AI/LLM security testing

🔹 Hardware/IoT/ICS security

🔹 Bug bounty or responsible disclosure work

🔹 Mobile (OWASP MASTG) and wireless testing familiarity

🎁 Benefits:

🔹 Annual gainshare bonus when company performance is above target

🔹 Funded personal development plan including certifications and conference attendance

🔹 Hybrid working

🔹 Benefits package

💰 Salary: £55,000 – £60,000

📩 Interested? Get in touch to find out more or send your CV directly.

#PenetrationTesting #SecurityTesting #CREST #OSCP #RedTeam #AISecurity #CyberSecurity #LondonJobs #InfoSecJobs