Cyber Security Consultant (Penetration Tester) in London

Cyber Security Consultant – Penetration Testing
London | Hybrid – 2 days per week in the office
£45,000–£55,000 + Benefits

We're working with a leading global professional services company that is investing significantly in the growth of its Cyber Risk Advisory practice and is looking to hire a Cyber Security Consultant with a strong background in penetration testing and technical security assessments.

This is a predominantly hands-on technical role, with around 70% of your time focused on technical security delivery, including penetration testing across web applications, APIs and internal/external infrastructure, alongside Cyber Essentials Plus and wider vulnerability and security assessments.

You'll work directly with a diverse portfolio of clients, identifying and safely validating security weaknesses, explaining the associated risks and providing practical recommendations to improve their overall security posture.

Alongside the technical work, you'll also have the opportunity to broaden your consulting experience across areas such as cyber risk, security controls, cloud security, audit readiness and security advisory.

With significant investment going into the practice, it's an excellent time to join a growing team where you'll have the opportunity to develop your technical expertise, gain exposure to a wide variety of clients and play a part in shaping the continued growth of the cyber offering.

What You'll Be Doing

• Delivering penetration testing engagements across web applications, APIs and internal/external network infrastructure.
• Working directly with clients to scope engagements, define objectives and agree appropriate rules of engagement.
• Using both manual and tool-assisted testing techniques aligned with recognised methodologies including OWASP, PTES and MITRE ATT&CK.
• Supporting the delivery of Cyber Essentials Plus assessments, including technical testing, remediation verification and helping clients through the certification process.
• Conducting wider technical security assessments, including vulnerability assessments, cloud security reviews and configuration reviews.
• Reviewing systems against recognised standards such as CIS Benchmarks and vendor hardening guidance.
• Identifying and validating vulnerabilities, assessing their potential impact and providing clear, practical remediation advice.
• Producing high-quality technical reports and presenting findings to both technical and non-technical stakeholders.
• Supporting broader cyber advisory engagements including cyber risk assessments, security control reviews, remediation planning and audit readiness.
• Keeping up to date with emerging vulnerabilities, attack techniques and developments across the wider threat landscape.

What We're Looking For

You'll ideally have professional experience delivering client-facing penetration testing engagements, either independently or as part of a wider consulting team.

We're particularly interested in experience across:

• Web application and API penetration testing
• Internal and external infrastructure penetration testing
• Cyber Essentials and Cyber Essentials Plus
• Vulnerability assessment and management
• Kali Linux, Burp Suite and Nmap
• Qualys and/or Nessus
• Windows and Linux security
• Active Directory and Microsoft Entra ID
• TCP/IP and network security
• OWASP and recognised penetration testing methodologies
• CIS Benchmarks and security configuration reviews
• Scripting using Python, PowerShell, Bash or similar

As this is a consulting position, you'll also need to be comfortable working directly with clients, explaining technical vulnerabilities and their business impact, producing clear reports and providing practical security advice.

Certifications

A recognised practical penetration testing certification would be beneficial, such as: CREST CRT, OSCP, OSWE, CSTM or equivalent.

Existing Cyber Essentials / Cyber Essentials Plus Assessor experience would also be highly desirable, although training can be provided where required.

Additional Experience

Any experience across the following would be advantageous:

• AWS, Azure or GCP security
• Microsoft 365 security
• Cloud penetration testing
• Mobile application testing
• Wireless security testing
• Social engineering or phishing assessments
• Cyber risk assessments
• Security control reviews
• ISO 27001, NIST or CIS Controls
• Security design and technical hardening

Why Consider This Opportunity?

This is an opportunity to join a leading global professional services organisation at a point of significant investment in its Cyber Risk Advisory capability.

You'll remain hands-on with penetration testing and technical security work while also gaining exposure to a broader range of cyber advisory engagements.

For someone looking to build a long-term career in security consulting, it offers a strong combination of hands-on penetration testing, Cyber Essentials Plus delivery, exposure to a diverse client base, broader cyber risk and advisory experience, professional development and genuine opportunities to progress.