Penetration Tester

Senior Penetration Tester

(For people who enjoy breaking things — and then explaining, calmly, why they broke.)

Location - Remote

Salary - £85,000-90,000

Must be based in England. No sponsorship available I am afraid.

I’m working with a 150‑year‑old client that’s acting far less like a legacy brand and far more like a tech organisation that just happens to be mainstream. They’re modernising everything - culture, systems, processes - and giving their tech teams the freedom to build, experiment, and actually ship things that matter.

They’ve got billions of transactions’ worth of data, thousands of experts to learn from, and a tech estate big enough to keep even the most seasoned security tester entertained - and they’re looking for a Senior Penetration Tester who can do far more than run a scanner and write a report.

About the team

Their team sits at the centre of protecting systems, data, and people. They work across the entire business, identifying risks, strengthening defences, and making security a habit rather than a compliance checkbox.

If you like accountability, curiosity, and continuous improvement - and you want to help shape how they think about security - you’ll fit in well.

What you’ll actually do

• Scope penetration tests across internal, external, and cloud‑hosted systems
• Perform manual WebApp and API penetration testing - not “click‑scan‑report”, but real exploitation
• Conduct Infrastructure penetration testing across Windows, Linux, and hybrid environments
• Test Cloud environments and identify misconfigurations, privilege escalation paths, and architectural weaknesses
• Produce detailed, actionable reports for both technical and non‑technical audiences
• Provide expert vulnerability feedback across multiple forums
• Perform QA on reports and vulnerability write‑ups to maintain consistency and quality
• Improve internal vulnerability database content
• Support teams in understanding vulnerabilities through constructive conversations
• Review external pen tests and provide formal feedback
• Mentor other testers and help close knowledge gaps
• Perform Purple Team activities - Red Team experience is a big advantage
• Review bug bounty findings and validate high‑severity issues
• Advise on secure design and architecture when needed
• Shape and improve testing processes to increase efficiency

You’ll be great for this role if you have

• Extensive manual WebApp testing experience - OWASP, business logic abuse, real exploitation
• Strong manual API testing experience - auth flaws, injection, access control
• Infrastructure testing expertise across Windows & Linux
• Cloud testing experience - AWS, Azure, GCP misconfigurations and attack paths
• Build review experience (MacOS is a bonus)
• Excellent technical writing skills
• Strong QA skills
• Ability to work independently and deliver on time
• Broad security best‑practice knowledge
• Certifications such as OSWE, OSCP, GIAC, CREST CRT/CCT
• Clear communication skills - written and spoken

Big pluses

• Mobile penetration testing experience - iOS, Android, hybrid apps
• AI/LLM penetration testing
• Red Team tradecraft - phishing, social engineering, malware/tooling
• AV/EDR evasion
• Scripting/programming - C, C++, C#, Python
• PCI, ASV, SSDLC knowledge
• Experience with SAST tools
• Ability to balance security vs business needs
• Mentoring experience

What you get in return

• Holiday allowance
• Bonus scheme
• Pension plan
• Discounts on gyms, restaurants, holidays, retail vouchers
• Flexible working and job‑share options
• A genuinely inclusive culture where they want to hear from you even if you don’t tick every box

Sound interesting? Give me a shout.