Penetration Tester

The work is varied. You’ll be testing across web applications, infrastructure, cloud environments and APIs, rather than being boxed into one particular area. There’ll also be opportunities to get involved in things like mobile, wireless, red teaming and newer areas of security as you develop.

What you’ll be doing

• Penetration testing across web apps, infrastructure, cloud and APIs
• Working with Active Directory and network environments
• Testing across AWS, Azure and/or GCP
• Using tools such as Burp Suite, Kali Linux, Nmap, vulnerability scanners and Metasploit
• Taking ownership of your own testing engagements
• Writing clear reports and talking clients through your findings
• Helping clients understand how vulnerabilities can actually be remediated
• Contributing ideas around testing approaches, tooling and methodology
• Sharing knowledge with other members of the team

This is a good one for someone who already has a few years of penetration testing experience under their belt and wants to keep progressing technically., You’ll ideally have around 3-5 years of hands-on penetration testing experience.

You don’t need to tick every box, but experience across a good mix of the below would be ideal:

• Web application penetration testing
• OWASP / Burp Suite
• Infrastructure and network testing
• Cloud security testing
• API testing
• Kali Linux

If you’ve got certifications such as CREST CPSA / CRT, OSCP, OSWE or something similar, even better.

There’s no degree requirement for this role. They’re much more interested in what you can actually do technically and the experience you’ve built up.

Not essential, but any exposure to the following would be a bonus:

• CI/CD security
• Red teaming
• Social engineering
• AI / LLM security
• Mobile security
• IoT / hardware security
• Bug bounty or responsible disclosure work