Penetration Testing Lead

• We’re looking for an experienced and highly capable Penetration Testing Lead to lead and evolve our penetration testing capability
• Reporting to the Offensive Security Lead, you’ll be accountable for the strategic direction, operational delivery and technical excellence of the team
• This role combines deep technical expertise with inspirational leadership, leading a team of highly skilled penetration testers while shaping the roadmap for both human-led and autonomous security testing across the Group
• Spanning traditional end-to-end penetration testing services and continuous assurance capabilities, you’ll work closely with engineering, security and business stakeholders, as well as the Autonomous Vulnerability Research and Harness Engineering teams, to continuously improve the Group’s security posture
• Our work style is hybrid, which involves spending at least two days per week, or 40% of our time, at one of our office locations above
• Draw on extensive hands-on penetration testing experience to shape testing strategy, guide the execution of complex application and infrastructure security assessments, and ensure the delivery of high-quality, risk-focused testing that helps strengthen the Group’s security posture
• Lead, mentor and develop a high-performing team of penetration testers, encouraging a culture of technical excellence, continuous improvement, innovation and open communication
• Define and carry out the Penetration Testing roadmap, ensuring alignment to CSO and wider Group security objectives while delivering a comprehensive security testing programme spanning threat resilience, regulatory, change-driven and continuous assurance testing
• Drive the evolution of autonomous security testing through close collaboration with the Autonomous Vulnerability Research and Harness Engineering teams, helping embed automation, frontier model testing and scalable security validation capabilities across the testing lifecycle
• Build positive relationships across the Chief Security Office and wider organisation. Communicate security risks, testing outcomes, and recommendations to technical practitioners and executives. Collaborate with teams to prioritise and remediate findings swiftly

Benefits

• A generous holiday allowance: You’ll be eligible for a minimum of 22 days holiday (excluding bank holidays), rising to 30 days based on length of service and grade.
• A flexible way of working: Whether you want flexibility over your location or when you log on, together we can create an approach that works for you and for the business.
• Family leave: Up to 63 weeks of maternity or adoption leave. Statutory maternity or adoption pay is available for 39 weeks, and 20 weeks will be enhanced to the equivalent of full pay. Partners can have six weeks of fully paid paternity leave.
• Flex cash: This is 4% of your basic salary and can be used to spend on the benefits of your choice, or you can choose to take it as a cash top up in your monthly salary.
• Health insurance: Our company funded Private Medical Benefit provides all colleagues with access to good quality medical care, including accommodation, nursing care and specialist advice.
• Colleague Offers: Get discounts on everything from electrical items to cinema tickets and weekly food shopping. You can share this benefit with up to ten family members or friends.
• Financial products: Take advantage of our great financial products, some at a discounted rate, including current accounts, home and car insurance and loans.
• Share plans: Participate in Sharematch and receive matching shares of up to £45 a month from the company, and you can choose to participate in Sharesave, our combined savings and share option plan.
• Pension: We offer a generous pension plan, with all joiners being automatically enrolled in our ‘Your Tomorrow’ scheme. You can decide how much you save and get a say in where your contributions are invested.- If you’re passionate about offensive security, enjoy developing high-performing teams, and want to influence cyber resilience at enterprise scale, we’d love to hear from you
• Experience building, developing and leading high-performing technical teams
• Passion for cyber security research, continuous learning and advancing security testing practices
• Strong understanding of penetration testing methodologies, vulnerability discovery techniques, offensive security tooling and attacker tradecraft
• Demonstrable expertise in conducting and supervising complex application, API, cloud, infrastructure and network penetration testing engagements
• Strong understanding of modern enterprise technology environments, cloud platforms, operating systems, networks, software development practices and security controls
• Extensive experience leading penetration testing, application security testing or offensive security functions within a large and complex organisation
• Excellent customer interaction skills, with the ability to communicate effectively with technical and non-technical audiences, including senior leadership
• Recognised offensive security certifications such as CREST, OSCP, OSCE, OSEP, GIAC, GWAPT, CPTS, CAPE or equivalent
• Software development, automation or engineering experience in any low-level or high-level language (C#, C++, C, Python, Bash, Java, Rust, etc.)
• Experience within financial services or other highly regulated environments
• Degree or postgraduate qualification in Cyber Security, Computer Science, or a related field, or equivalent experience
• Familiarity with autonomous vulnerability discovery, AI-enabled security testing, frontier model evaluation, fuzzing frameworks and modern security engineering practices- End Date: September 13, 2026