Find a job 
Featured Companies 
Featured Universities 
For Companies At a Glance
- Tasks: Conduct penetration tests and collaborate on building resilient systems.
- Company: Join Engine by Starling, a tech-driven company transforming banking.
- Benefits: Enjoy 25 days holiday, private medical insurance, and flexible working.
- Why this job: Make a real impact in cybersecurity while developing your skills.
- Qualifications: 5+ years in penetration testing with cloud and application security expertise.
- Other info: Dynamic team environment with opportunities for continuous learning and growth.
The predicted salary is between 48000 - 72000 £ per year.
We are looking for an experienced Penetration Tester who can bridge the gap between deep technical exploitation and real-world business risk. This role sits within the Information Security team but collaborates across Infrastructure Engineers, Software Developers and other parts of the Information Security Team. The aim is to move beyond finding 'bugs' to helping build inherently resilient systems, with an emphasis on adversarial empathy and communicating risk to non-technical stakeholders.
As an early member of our internal Pentesting capability, you will help write the testing approach and capabilities, not just follow a manual. A key aspect of this role involves collaboration, continuous improvement, and automation initiatives.
Responsibilities- End-to-End Assessments: Conduct penetration tests on our core banking platform, focusing on Cloud and Application Security.
- Code Review: Perform manual secure code reviews to identify logic flaws and security anti-patterns.
- Threat Modelling: Participate in sessions with different teams to identify design flaws before code is written.
- Risk Contextualisation: Contextualise technical vulnerabilities into 'Real-World Risk' scenarios to demonstrate business impact to non-technical executives and within Engine's risk management framework.
- Cloud Security: Collaborate with Infrastructure teams to audit and secure cloud configurations.
- Autonomous Execution: Act as an independent operator within the team, managing your own testing scope and timelines across different business domains.
- Remediation: Provide clear, actionable remediation advice that balances security requirements with engineering velocity.
- Strategic Reporting: Translate complex technical exploits into actionable business risk summaries for non-technical stakeholders and executive leadership.
- Knowledge Sharing and Framework Development: Collaborate with peers to design a continuous testing framework that evolves with our tech stack and share knowledge to elevate our security posture.
- Experience: 5+ years in penetration testing with a focus on cloud-native infrastructure, web applications, and APIs.
- Tooling: Expert-level proficiency with industry-standard tools; ability to work manually when scanners fail.
- Cloud Native: Experience with Cloud Security (AWS/GCP), specifically AWS/EKS.
- Code Fluency: Ability to conduct code reviews in multiple languages, primarily Java and Go.
- Mobile: Experience testing Mobile Applications (iOS and Android).
- Design Review: Proven experience in Threat Modelling.
- SDLC: Understanding of how software is architected, built and deployed.
- Scripting: Ability to write scripts and tooling to aid pentesting (Golang, Python, etc.).
- Communication: Exceptional written and spoken communication skills; ability to explain complex technical issues to engineers and business risk to executives.
- Proactivity: Self-starting; you don’t wait for a ticket to find vulnerabilities and you’ll engage with codebases during downtime.
- Independence: Ability to work independently while remaining collaborative with the engineering team.
- Adaptability: Able to evolve as our requirements shift over time.
- Certifications: Relevant industry certifications (OSCP, OSWE, CCT-APP, CCT-INF, etc.) or demonstrable experience.
- Infrastructure as Code (IaC): Experience auditing Terraform or CloudFormation templates.
- DevSecOps: Familiarity with integrating security tooling (DAST/SAST) into CI/CD pipelines.
About Engine by Starling: Engine is Starling’s SaaS business powering Starling Bank. We are on a mission to build rapid growth businesses for leading banks worldwide using our technology. We are an engineering-led company seeking someone excited by the potential of Engine’s technology to transform banking in different markets. We operate with a hybrid working model; attendance at a local office is preferred to enable collaboration in person.
Benefits- 25 days holiday (plus public holiday allowance)
- Extra day off for your birthday
- Annual leave increases with tenure; buy/sell up to five extra days
- 16 hours paid volunteering time per year
- Salary sacrifice, company-enhanced pension scheme
- Life insurance (4x salary) & group income protection
- Private Medical Insurance with VitalityHealth including mental health and cancer care; partner discounts with Waitrose, Mr & Mrs Smith, Peloton
- Generous family-friendly policies
- Perkbox for retail discounts and wellbeing resources
- Cycle to Work, Salary Sacrificed Gym partnerships and EV leasing
Starling Bank is an equal opportunity employer. We evaluate applicants without regard to race, religion, national origin, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, disability, military status, or any other protected characteristic. By applying, you consent to Starling Bank processing your information for recruiting purposes in accordance with our Privacy Notice.
Penetration Tester - Engine by Starling in Southampton employer: The Engine
Contact Detail:
The Engine Recruiting Team
StudySmarter Expert Advice 🤫
We think this is how you could land Penetration Tester - Engine by Starling in Southampton
✨Tip Number 1
Network like a pro! Reach out to folks in the industry, attend meetups, and connect with potential colleagues on LinkedIn. You never know who might have the inside scoop on job openings or can put in a good word for you.
✨Tip Number 2
Show off your skills! Create a portfolio showcasing your penetration testing projects, including any cool scripts or tools you've developed. This will not only impress employers but also give them a taste of what you can bring to the table.
✨Tip Number 3
Prepare for interviews by brushing up on your communication skills. Practice explaining complex technical concepts in simple terms, as you'll need to convey risks to non-technical stakeholders. Role-playing with a friend can help!
✨Tip Number 4
Don't forget to apply through our website! It’s the best way to ensure your application gets seen by the right people. Plus, it shows you're genuinely interested in joining our team at Engine by Starling.
We think you need these skills to ace Penetration Tester - Engine by Starling in Southampton
Some tips for your application 🫡
Tailor Your CV: Make sure your CV is tailored to the Penetration Tester role. Highlight your experience with cloud security, code reviews, and any relevant certifications. We want to see how your skills align with our needs!
Craft a Compelling Cover Letter: Your cover letter is your chance to shine! Use it to explain why you're passionate about penetration testing and how you can contribute to our mission at Engine by Starling. Keep it engaging and relevant!
Showcase Your Communication Skills: Since this role involves translating technical jargon into business risk, make sure to demonstrate your communication skills in your application. We love candidates who can bridge the gap between tech and non-tech folks!
Apply Through Our Website: We encourage you to apply directly through our website. It’s the best way for us to receive your application and ensures you’re considered for the role. Plus, it’s super easy!
How to prepare for a job interview at The Engine
✨Know Your Stuff
Make sure you brush up on your technical skills, especially around cloud security and penetration testing tools. Be ready to discuss your experience with AWS or GCP, and how you've tackled real-world vulnerabilities in the past.
✨Communicate Clearly
Since this role involves translating complex technical issues into business risks, practice explaining your past projects in simple terms. Think about how you can convey the impact of a vulnerability to non-technical stakeholders.
✨Show Your Collaborative Side
This position requires working closely with various teams. Prepare examples of how you've successfully collaborated in the past, whether it was during code reviews or threat modelling sessions. Highlight your ability to work independently while still being a team player.
✨Be Proactive
Demonstrate your proactive nature by discussing times when you took the initiative to find vulnerabilities or improve security processes. Show that you're not just waiting for tasks but actively engaging with codebases and security practices.
