Senior Penetration Tester - Cloud

Senior AWS Cloud Penetration Tester / CHECK Team Lead

UK Government | SC Cleared or Recently Lapsed | AWS Cloud-Native Security Testing | Contract

Location: UK Remote / Hybrid

Duration: 6-12 Months Initial

Rate: Competitive Day Rate

Clearance: Active SC Required

The Opportunity

This role sits within a major UK Government offensive security programme supporting critical national services.

This is a cloud penetration testing role. It is not a traditional infrastructure penetration testing role.

We are specifically looking for a consultant who already has deep experience assessing and attacking AWS-native environments . This is not a position for infrastructure testers looking to move into cloud security.

The successful candidate will spend their time assessing cloud-native architectures, AWS services, Kubernetes environments, APIs, identity architectures, Infrastructure-as-Code, and DevSecOps pipelines.

You'll work alongside a team of experienced cloud security practitioners delivering high-quality offensive security assessments across some of the UK's most critical platforms.

What You'll Be Doing

• Lead and deliver cloud-focused penetration testing engagements.
• Conduct offensive security assessments against AWS-native environments.
• Test cloud-hosted applications, APIs, microservices, and serverless architectures.
• Assess AWS identity and access management controls and attack paths.
• Review Infrastructure-as-Code implementations including Terraform and CloudFormation.
• Assess Kubernetes, EKS and containerised environments.
• Perform CI/CD and DevSecOps security reviews.
• Produce clear, risk-based technical and executive reporting.
• Present findings directly to engineering teams, security leadership and senior stakeholders.
• Mentor and support other testers across cloud security engagements.
• Participate in technical discussions, risk reviews and remediation workshops.

Essential Experience

We are looking for candidates who can demonstrate hands-on experience across multiple areas below:

AWS Security Testing

Strong practical experience assessing and attacking AWS environments including:

• IAM
• AWS Organizations
• Control Tower
• VPC
• Security Groups
• S3
• Lambda
• ECS
• EKS
• CloudTrail
• CloudFormation
• Secrets Manager
• KMS

Cloud-Native Security

• Kubernetes security assessments
• Container security testing
• API security testing
• Microservice architectures
• Serverless security
• Identity attack path analysis
• Cloud privilege escalation scenarios

DevSecOps & Infrastructure as Code

• Terraform security reviews
• Infrastructure-as-Code assessments
• CI/CD pipeline testing
• Git-based development workflows
• Security testing within cloud-native delivery environments

What We Are Not Looking For

Candidates whose experience is primarily focused on:

• Internal network penetration testing
• Active Directory-only assessments
• Traditional infrastructure testing
• Vulnerability management programmes
• Cloud governance or security architecture without offensive security delivery
• WAF administration or cloud engineering without penetration testing experience

While these skills may be useful, the successful candidate must be able to demonstrate hands-on cloud-native offensive security expertise first and foremost.

Certifications

One or more of the following:

• OSCP
• OSWE
• OSEP
• CRT
• CCT
• CCSAS
• CHECK Team Member (CTM)
• CHECK Team Leader (CTL)

Highly Desireable

• AWS Security Specialty
• AWS Solutions Architect Associate/Professional
• Certified Kubernetes Administrator (CKA)
• CCSP

Clearance

Active SC Clearance is required or Recently lapsed

Previous experience working within UK Government, DWP, Home Office, Defence, or other central government programmes would be highly advantageous.

Ideal Candidate

The ideal consultant will be able to demonstrate recent examples of:

• AWS penetration testing engagements
• IAM privilege escalation assessments
• EKS/Kubernetes security testing
• API and microservice assessments
• Terraform or CloudFormation reviews
• Cloud-native attack path analysis
• Adversarial testing in AWS environments

If your experience is primarily infrastructure testing with occasional cloud exposure, this role is unlikely to be a match. We are specifically seeking an AWS-focused cloud penetration tester with proven offensive security experience in modern cloud-native environments.