IS Tester in City of Westminster

We'd all like amazing work to do, and real work-life balance. That's waiting for you at Sainsbury's. Think about the scale it takes for us to feed the nation. The level of data, transactions and variety it involves. Then you'll realise that ours is a modern software engineering environment because it has to be. We've made serious investment into a Tech Academy and into setting standards and principles. We iterate, learn, experiment and push ways of working such as Agile, Scrum and XP. So you can look forward to awesome opportunities in everything from AI to reusable tech. The big question: why on earth should a Tech professional like you work for a 150-year-old retail chain? Because we're on a journey. Changing the way we operate. Learning to think nimble. Giving our teams the time and freedom they need to push boundaries. To create amazing systems and technologies. To give our colleagues and our customers even more incredible experiences. There are thousands of experts to talk to and learn from. We've got data from billions of transactions for our teams to play with. Things get built here. They get made here. They hit customers and colleagues quickly. Welcome to the home of Sainsbury's Tech. About the Team Our Data Governance & Information Security team is at the heart of protecting the organisation's systems, data, and people. We work across all areas of the business to identify risks, strengthen defences, and ensure compliance with industry standards and regulations. We value accountability, curiosity, and continuous improvement, and we're passionate about building a culture where security is second nature. Joining us means being part of a team that tackles evolving threats, drives awareness, and helps the organisation remain resilient and trusted. More about the role: The Senior Information Security Tester will be engaged in delivering Penetration Testing & related services and will:

• Scope penetration testing for both internal and external facing systems
• Take ownership and perform a wide range of penetration tests in line with internal standards and SLAs, including detailed and actionable reporting through our reporting platform
• Provide expert feedback in several forums related to technical vulnerabilities and processes within and outside of the security testing team
• Performing Quality Assurance on in-house reports, vulnerability database write-ups, and any related documentation related to the security testing team's function
• Improve internal vulnerability database write-ups to increase overall quality of all reports
• Be able to assist other teams in understanding security vulnerabilities and implications through constructive conversations & meetings when engaged through security testing, or as part of the wider conversation
• Periodically review external penetration tests as part of ongoing vendor evaluation, along with providing formal feedback for any issues and participating in resolution meetings
• Provide mentorship to others within the team, along with assisting to fill in any knowledge gaps when identified
• Be able to perform Purple Team activities as required, with Red Team capabilities a large advantage
• Participate in reviewing bug bounty findings and providing feedback for issues which are of high severity, complexity, and exceeding a reward threshold
• Have the opportunity to provide advice and guidance associated with the planning, design, implementation and improvement of system security taking account of current best practice, legislation and regulation when necessary
• Help shape the security testing process by providing feedback highlighting opportunities for improvement in efficiency and ways of working
  Extensive experience performing Web Application penetration tests
• Extensive knowledge of OWASP vulnerabilities, tools and methodologies
• Strong Experience performing Infrastructure penetration tests against Windows & Linux environments
• Strong Experience performing build reviews against Windows & Linux hosts, MacOS a bonus
• Strong technical writing ability to write penetration test reports for technical and non-technical audiences
• Strong reporting Quality Assurance skills
• Ability to work on their own with minimal supervision and deliver on time to budget
• Demonstrates

#J-18808-Ljbffr