About the role
You will scope and deliver authorised penetration tests across web applications, APIs, infrastructure, cloud and wireless. You will find and exploit weaknesses, then write clear reports that help clients fix them. All testing is done under written client permission and an agreed scope.
What you will do
- Scope engagements and agree testing objectives with clients
- Deliver web, API, infrastructure, cloud and wireless tests (OWASP, PTES)
- Run red team and social engineering exercises when agreed in writing
- Write clear reports with risk ratings and practical fixes
- Retest fixes and advise development and IT teams
- Keep up with new attack techniques and share knowledge
Minimum qualifications
- Bachelor's degree in Cyber Security, Computer Science or a related field, or equivalent practical experience
- 4+ years delivering penetration tests for clients
- CHECK Team Member status, or CREST CCT (INF or APP)
- Current CREST CRT or OSCP
- A sample report you wrote (redacted) or public CVEs or write-ups
- Testing to OWASP WSTG, PTES and MITRE ATT&CK
- Willing to pass BPSS screening and eligible for UK SC clearance
- English at CEFR C1 or above (IELTS 7.0 or equivalent)
Expert knowledge
- Test methodology and reporting to OWASP WSTG, PTES and CREST standards
- Risk rating of findings with CVSS v4 and clear business impact
- Rules of engagement, scoping and legal authorisation under the Computer Misuse Act 1990
- Security assessment of Active Directory and cloud environments to CHECK standards
Preferred qualifications
- OSWE, OSEP or OSCE3
- CHECK Team Leader status
- Published CVEs or conference talks
- Active Directory and Azure attack paths (CRTO or CARTP)
Before any offer we verify your certificates, qualifications, references and right to work in the UK. Security roles also need background screening (BPSS) and may need security clearance.
SOWTK is an equal opportunity employer. We welcome applicants of every background and do not discriminate on any characteristic protected by the Equality Act 2010.