Find a job 
Featured Companies 
Featured Universities 
For Companies At a Glance
- Tasks: Conduct penetration tests and collaborate on building resilient systems.
- Company: Join Engine by Starling, a tech-driven company transforming banking.
- Benefits: Enjoy 25 days holiday, private medical insurance, and flexible working.
- Why this job: Make a real impact in cybersecurity while developing your skills.
- Qualifications: 5+ years in penetration testing with cloud and application security expertise.
- Other info: Dynamic team environment with opportunities for continuous learning and growth.
The predicted salary is between 48000 - 72000 £ per year.
We are looking for an experienced Penetration Tester who can bridge the gap between deep technical exploitation and real-world business risk. This role sits within the Information Security team but collaborates across Infrastructure Engineers, Software Developers and other parts of the Information Security Team. The aim is to move beyond finding 'bugs' to helping build inherently resilient systems, with an emphasis on adversarial empathy and communicating risk to non-technical stakeholders.
As an early member of our internal Pentesting capability, you will help write the testing approach and capabilities, not just follow a manual. A key aspect of this role involves collaboration, continuous improvement, and automation initiatives.
Responsibilities
- End-to-End Assessments: Conduct penetration tests on our core banking platform, focusing on Cloud and Application Security.
- Code Review: Perform manual secure code reviews to identify logic flaws and security anti-patterns.
- Threat Modelling: Participate in sessions with different teams to identify design flaws before code is written.
- Risk Contextualisation: Contextualise technical vulnerabilities into 'Real-World Risk' scenarios to demonstrate business impact to non-technical executives and within Engine's risk management framework.
- Cloud Security: Collaborate with Infrastructure teams to audit and secure cloud configurations.
- Autonomous Execution: Act as an independent operator within the team, managing your own testing scope and timelines across different business domains.
- Remediation: Provide clear, actionable remediation advice that balances security requirements with engineering velocity.
- Strategic Reporting: Translate complex technical exploits into actionable business risk summaries for non-technical stakeholders and executive leadership.
- Knowledge Sharing and Framework Development: Collaborate with peers to design a continuous testing framework that evolves with our tech stack and share knowledge to elevate our security posture.
Technical Skills
- Experience: 5+ years in penetration testing with a focus on cloud-native infrastructure, web applications, and APIs.
- Tooling: Expert-level proficiency with industry-standard tools; ability to work manually when scanners fail.
- Cloud Native: Experience with Cloud Security (AWS/GCP), specifically AWS/EKS.
- Code Fluency: Ability to conduct code reviews in multiple languages, primarily Java and Go.
- Mobile: Experience testing Mobile Applications (iOS and Android).
- Design Review: Proven experience in Threat Modelling.
- SDLC: Understanding of how software is architected, built and deployed.
- Scripting: Ability to write scripts and tooling to aid pentesting (Golang, Python, etc.).
Soft Skills
- Communication: Exceptional written and spoken communication skills; ability to explain complex technical issues to engineers and business risk to executives.
- Proactivity: Self-starting; you don’t wait for a ticket to find vulnerabilities and you’ll engage with codebases during downtime.
- Independence: Ability to work independently while remaining collaborative with the engineering team.
- Adaptability: Able to evolve as our requirements shift over time.
Certifications
- Relevant industry certifications (OSCP, OSWE, CCT-APP, CCT-INF, etc.) or demonstrable experience.
Nice to Have
- Infrastructure as Code (IaC): Experience auditing Terraform or CloudFormation templates.
- DevSecOps: Familiarity with integrating security tooling (DAST/SAST) into CI/CD pipelines.
About Engine by Starling
Engine is Starling’s SaaS business powering Starling Bank. We are on a mission to build rapid growth businesses for leading banks worldwide using our technology. We are an engineering-led company seeking someone excited by the potential of Engine’s technology to transform banking in different markets. We operate with a hybrid working model; attendance at a local office is preferred to enable collaboration in person.
Benefits
- 25 days holiday (plus public holiday allowance)
- Extra day off for your birthday
- Annual leave increases with tenure; buy/sell up to five extra days
- 16 hours paid volunteering time per year
- Salary sacrifice, company-enhanced pension scheme
- Life insurance (4x salary) & group income protection
- Private Medical Insurance with VitalityHealth including mental health and cancer care; partner discounts with Waitrose, Mr & Mrs Smith, Peloton
- Generous family-friendly policies
- Perkbox for retail discounts and wellbeing resources
- Cycle to Work, Salary Sacrificed Gym partnerships and EV leasing
Starling Bank is an equal opportunity employer. We evaluate applicants without regard to race, religion, national origin, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, disability, military status, or any other protected characteristic. By applying, you consent to Starling Bank processing your information for recruiting purposes in accordance with our Privacy Notice.
Penetration Tester - Engine by Starling in Manchester employer: The Engine
Contact Detail:
The Engine Recruiting Team
StudySmarter Expert Advice 🤫
We think this is how you could land Penetration Tester - Engine by Starling in Manchester
✨Tip Number 1
Network like a pro! Reach out to folks in the industry on LinkedIn or at meetups. We all know that sometimes it’s not just what you know, but who you know that can get you in the door.
✨Tip Number 2
Show off your skills! Create a portfolio of your pentesting projects or write-ups. We love seeing real-world examples of your work, and it gives you a chance to demonstrate your expertise beyond just a CV.
✨Tip Number 3
Prepare for interviews by practising common questions and scenarios. We recommend doing mock interviews with friends or mentors to build confidence and refine your communication skills.
✨Tip Number 4
Don’t forget to apply through our website! It’s the best way to ensure your application gets seen by the right people. Plus, we’re always looking for passionate individuals who want to make a difference in the tech world.
We think you need these skills to ace Penetration Tester - Engine by Starling in Manchester
Some tips for your application 🫡
Tailor Your CV: Make sure your CV is tailored to the Penetration Tester role. Highlight your experience with cloud security, code reviews, and any relevant certifications. We want to see how your skills align with our needs!
Craft a Compelling Cover Letter: Your cover letter is your chance to shine! Use it to explain why you're passionate about penetration testing and how you can contribute to our mission at Engine by Starling. Keep it engaging and relevant!
Showcase Your Communication Skills: Since this role involves translating technical jargon into business risk, make sure to demonstrate your communication skills in your application. We love candidates who can bridge the gap between tech and non-tech folks!
Apply Through Our Website: We encourage you to apply directly through our website. It’s the best way for us to receive your application and ensures you’re considered for the role. Plus, it’s super easy!
How to prepare for a job interview at The Engine
✨Know Your Stuff
Make sure you brush up on your penetration testing skills, especially around cloud-native infrastructure and web applications. Familiarise yourself with the tools you'll be using and be ready to discuss your experience with AWS or GCP, as well as your coding fluency in languages like Java and Go.
✨Communicate Clearly
Since this role involves translating complex technical issues into business risks, practice explaining your past projects and findings in simple terms. Think about how you would present a vulnerability to a non-technical stakeholder and prepare some examples to illustrate your points.
✨Show Your Collaborative Side
This position requires working closely with various teams, so be prepared to discuss how you've collaborated in the past. Share specific examples of how you’ve engaged with engineers or other departments to improve security practices or resolve issues.
✨Be Proactive and Independent
Demonstrate your self-starting attitude by sharing instances where you took the initiative to find vulnerabilities or improve processes without being prompted. Highlight your ability to manage your own testing scope and timelines while still being a team player.
