> Markdown version of [/jobs/ext/1623289-penetration-tester](https://www.wearedevelopers.com/jobs/ext/1623289-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Penetration Tester

- **Company:** RSA Group
- **Location:** UK
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Software System Penetration Testing, Web Applications, Cloud Platform System, Purple Team (Cyber Security), Vulnerability Analysis
- **Published:** July 3, 2026
- **Apply:** https://www.rsagroup.com/careers/search-our-vacancies/uk-job-description?jobId=186518

## About the Role

* Experience delivering penetration testing across web applications, APIs, infrastructure, and cloud environments.
 * Excellent understanding of common vulnerability classes and attacker techniques, including those aligned to recognised industry guidance.
 * Ability to apply penetration testing methodologies and tools in practical testing scenarios and interpret vulnerability scanning results.
 * Ability to produce clear, structured reports that explain technical risk and remediation for technical and non technical audiences.
 * Interest in developing offensive security capability and contributing to continuous improvement through learning and knowledge sharing.

## Description

* Delivering penetration testing across applications, infrastructure, APIs, and cloud environments to identify and validate security weaknesses.
 * Contributing to end-to-end testing activities including reconnaissance, exploitation, and reporting using recognised industry methodologies.
 * Supporting the oversight of external penetration testing suppliers through scoping, quality review, and validation of findings.
 * Working with development and delivery teams to embed proportionate security testing into projects and change.
 * Collaborating with Cyber Defence colleagues during remediation, investigations, and purple team activities to translate technical issues into business risk
 * Delivering penetration testing across applications, infrastructure, APIs, and cloud environments to identify and validate security weaknesses.
 * Contributing to end-to-end testing activities including reconnaissance, exploitation, and reporting using recognised industry methodologies.
 * Supporting the oversight of external penetration testing suppliers through scoping, quality review, and validation of findings.
 * Working with development and delivery teams to embed proportionate security testing into projects and change.
 * Collaborating with Cyber Defence colleagues during remediation, investigations, and purple team activities to translate technical issues into business risk


## Related Videos

- [How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR](https://www.wearedevelopers.com/videos/39-how-to-cause-or-prevent-a-massive-data-breach-secure-coding-and-idor)
- [It's a (testing) trap! - Common testing pitfalls and how to solve them](https://www.wearedevelopers.com/videos/1193-it-s-a-testing-trap-common-testing-pitfalls-and-how-to-solve-them)
- [Generate AI in the Browser with Chrome AI - Raymond Camden](https://www.wearedevelopers.com/videos/1770-generate-ai-in-the-browser-with-chrome-ai-raymond-camden)
- [Cloud Vendor Lock-In - Is it just a new version of the Database Abstraction Layers?](https://www.wearedevelopers.com/videos/1185-cloud-vendor-lock-in-is-it-just-a-new-version-of-the-database-abstraction-layers)
- [Securing Your Web Application Pipeline From Intruders](https://www.wearedevelopers.com/videos/53-securing-your-web-application-pipeline-from-intruders)
- [Lessons learned from observing a billion API requests](https://www.wearedevelopers.com/videos/1574-lessons-learned-from-observing-a-billion-api-requests)

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)