Penetration Tester in London

We are looking for a hands-on Penetration Tester / Red Teamer to conduct security testing in customer environments, investigate vulnerabilities, validate findings generated by autonomous security agents, and help improve their effectiveness.

This is a mid-level role based in London, with a hybrid working arrangement requiring three days per week in the office.

You will work closely with security researchers and engineers to reproduce vulnerabilities, demonstrate their real‑world impact, and turn your findings into actionable improvements.

The role combines practical offensive security with technical investigation and product development.

We value practical skills, sound technical judgement and a methodical approach to security testing over certifications alone.

Previous experience with AI is not required.

Key Responsibilities

• Conduct penetration tests across web applications, APIs and infrastructure, with support on more complex engagements.
• Support red‑team exercises by identifying attack paths, investigating weaknesses and contributing to exploitation activities.
• Manually investigate and validate vulnerabilities identified by autonomous security agents, distinguishing genuine issues from false positives.
• Develop and execute proof‑of‑concept exploits to demonstrate reproducibility, exploitability, impact and attack prerequisites.
• Identify and investigate common security weaknesses, including access‑control flaws, authentication vulnerabilities and injection issues.
• Produce clear, concise technical reports documenting findings, reproduction steps, supporting evidence, risk and remediation recommendations.
• Develop and adapt Python scripts, tooling and repeatable test cases to support security assessments and improve testing efficiency.
• Collaborate with engineers and researchers to improve agent behaviour, vulnerability detection, testing coverage and finding quality.
• Translate security research and practical testing experience into improvements to the product and its underlying capabilities.
• Work responsibly within agreed testing scopes, communicating findings clearly and exercising sound judgement in customer environments.
• Required Skills and Experience
• Hands‑on experience in penetration testing, an internal offensive‑security team or substantive bug‑bounty and vulnerability research.
• Strong understanding of common vulnerabilities, exploitation techniques and manual testing methodologies.
• Practical experience investigating and exploiting vulnerabilities, rather than relying solely on automated scanners.
• Experience testing web applications and APIs, with an understanding of authentication, authorisation and access‑control mechanisms.
• Exposure to infrastructure security testing, with the ability to investigate weaknesses beyond the application layer.
• Familiarity with offensive‑security tools such as Burp Suite and Nmap, including the ability to interpret, verify and challenge their results.
• Ability to write or adapt Python scripts to automate tasks, develop testing utilities and support vulnerability investigation.
• Ability to create reproducible proof‑of‑concept demonstrations and explain the technical conditions and impact of a vulnerability.
• Strong technical writing and communication skills, including the ability to document findings and provide practical remediation guidance.
• A curious, analytical and persistent approach to problem‑solving, with the judgement to work independently and seek guidance when needed.
• Experience in one or more of the following areas would be advantageous:
• Red teaming, adversary emulation or attack‑path analysis.
• Active Directory security and privilege escalation.
• Cloud security assessments.
• Internal and external infrastructure penetration testing.
• Exploit development or deeper vulnerability research.
• Security tooling, automation, public research, technical write‑ups or contributions to the security community.

What Matters Most

Practical offensive‑security ability is more important than formal qualifications. Certifications such as OSCP are welcome but not required.

Previous AI or autonomous‑agent experience is also not required.

What matters is your ability to investigate targets methodically, validate vulnerabilities, demonstrate impact and communicate your findings clearly.

An interest in how autonomous agents can support offensive‑security testing is a plus.

What You Can Expect

• Hands‑on security testing in real customer environments.
• Close collaboration with experienced security researchers and engineers.
• The opportunity to influence the development of autonomous offensive‑security capabilities through practical testing and research.
• Meaningful responsibility within a small, technically focused team.
• Opportunities to deepen your expertise through challenging engagements, vulnerability investigation and continuous technical development.

You do not need experience across every area. We are interested in candidates who can demonstrate strong practical skills and a willingness to develop further.

By submitting your application, you agree to the processing of your personal data in accordance with our Privacy Policy.

#J-18808-Ljbffr