> Markdown version of [/jobs/ext/4017004-penetration-tester](https://www.wearedevelopers.com/jobs/ext/4017004-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Penetration Tester

- **Company:** Ocho People
- **Location:** Belfast, UK
- **Salary:** £40,000.0 - £50,000.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Applications Architecture, Software System Penetration Testing, Burp Suite, Kali Linux, Open Web Application Security, Wireshark, Web Applications, Web Testing, GWAPT, Metasploit, Nessus, Graphql, Appscan, Api Management, Vulnerability Analysis
- **Published:** October 30, 2026
- **Apply:** https://www.adzuna.co.uk/jobs/details/5946232036

## About the Role

* Hands-on penetration testing, including significant manual web application testing, is essential, and the single most important thing we are looking for.
 * Strong hands-on use of Burp Suite and Kali Linux is essential.
 * Solid knowledge of the OWASP Top 10, CVEs and exploitation techniques is essential.
 * A clear understanding of how a vulnerability assessment differs from a penetration test is essential.
 * The ability to write clear reports and explain technical findings to non-technical colleagues is essential.
 * API testing experience across REST, GraphQL, authentication and authorisation is highly advantageous.
 * Experience of application architecture reviews is highly advantageous.
 * Experience testing AI-enabled applications or agents, or using AI to support your testing, is a strong advantage.
 * OSCP is a strong advantage, though practical testing experience counts for more than certifications alone.
 * Experience with Nessus, AppScan, Nipper, Metasploit or Wireshark is desirable.
 * CISSP, GPEN, GWAPT, GAIPT, CEH or other GIAC certifications are desirable.

## Description

A hands-on penetration testing role delivering web application, API and systems assessments for a global law firm, based in Belfast with 2 days a week on site, paying £40,000 to £50,000., You will join the in-house penetration testing team and deliver assessments independently, with much of your time spent on manual testing of live web applications and APIs. This is a hands-on technical role where your testing ability matters far more than polish. As the firm's AI adoption grows, you will also help assess the security of AI-enabled applications and agents. Offensive, hands-on experience from any sector is welcome, whether that is consultancy, financial services, tech, government, defence or elsewhere., * Deliver hands-on penetration tests across the firm's applications, platforms and systems, working independently.

 * Carry out manual web application testing against live applications using OWASP-based methodologies.
 * Test APIs, including REST and GraphQL services and their authentication and authorisation controls.
 * Identify, validate and exploit vulnerabilities, accurately confirming which findings are real.
 * Write clear reports with practical, actionable recommendations for technical and non-technical audiences.
 * Contribute to application architecture reviews.
 * Help assess the security of AI-enabled applications and agents as the firm's use of AI grows.
 * Work with the team to clear the existing testing backlog and increase testing capacity.