> Markdown version of [/jobs/ext/4666388-penetration-tester-ai-security-engineer](https://www.wearedevelopers.com/jobs/ext/4666388-penetration-tester-ai-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Penetration Tester & AI Security Engineer

- **Company:** Javelin Global Commodities
- **Location:** London, United Kingdom
- **Salary:** £64,449
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Active Directory, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Microsoft Azure, Burp Suite, Information Leak Prevention, Linux, Python (Programming Language), OAuth, OpenID, Open Web Application Security, Windows PowerShell, Azure Active Directory, Azure Machine Learning, Secure Coding, Systems Integration, Web Applications, Enterprise Data Management, Scripting, Cloud Platform System, Software Security, Agentic-AI, Microsoft Copilot Studio, Azure AI, Restful APIs
- **Published:** November 11, 2026
- **Apply:** https://www.adzuna.co.uk/jobs/details/5960381765

## About the Role

Skills and Experience Required

 * Proven experience in penetration testing across infrastructure, web applications, APIs and cloud environments

 * Strong knowledge of Active Directory, Microsoft Entra ID, Microsoft 365, Azure and AWS, as well as networking and Windows/Linux

 * Experience with application security tools and concepts such as Burp Suite, OAuth/OIDC, REST APIs and secure development principles

 * Understanding of AI and large language model security, including prompt-injection testing, AI red teaming, data-leakage and access-control testing, and OWASP AI security guidance

 * Scripting ability in PowerShell and/or Python; experience with Microsoft Copilot Studio or Azure AI is desirable

 * Ability to communicate technical findings clearly and with confidence to all levels of the business.

## Description

Javelin is looking for a Penetration Tester & AI Security Engineer to join our London Infrastructure team, responsible for identifying and validating security weaknesses across Javelin's infrastructure, applications and emerging AI capabilities. This is a new role that combines traditional penetration testing with AI security testing, secure AI development and the security assessment of new client-facing solutions. The individual will work closely with Infrastructure, development teams, business stakeholders and external security partners to identify vulnerabilities, demonstrate their potential impact and support their remediation. A key part of the role will be helping Javelin adopt AI technologies securely, including developing approved in-house AI solutions, testing AI security controls, conducting AI red-team exercises and ensuring AI applications and agents operate within clearly defined security and data-access boundaries. There will also be the opportunity to support new client
engagements by performing authorised security testing of new platforms, applications and integrations, helping ensure security is built in from initial design through to production. The role is based full time in Javelin's London office, a short walk from Victoria train and bus station.

Key Responsibilities Include:

 * Conduct penetration testing across Javelin's infrastructure, applications, networks, Active Directory and cloud environments.

 * Identify vulnerabilities, demonstrate their potential impact and work with Infrastructure teams on remediation and retesting.

 * Perform authorised security testing of new client-facing platforms, applications and integrations before they go live, and provide security sign-off recommendations.

 * Support the secure development of in-house AI solutions, including AI agents, automation and integrations, using Microsoft Copilot Studio, Azure AI services and other approved platforms.

 * Ensure AI solutions follow Javelin's security, privacy, access-control and data-protection requirements.

 * Test AI security controls, including prompt injection, data leakage, excessive permissions and attempts to bypass AI guardrails.
 * Conduct controlled AI red-team testing to identify weaknesses in AI applications and agents.
 * Test that AI systems respect existing user permissions and cannot expose confidential Javelin or client information.
 * Review AI identities, API permissions and access to systems such as Microsoft 365, Azure and corporate data.
 * Help develop Javelin's standards for secure AI development, testing and deployment, and produce clear technical findings and management-level reporting with practical recommendations for remediation.