Job Search

We are seeking an experienced Principal Penetration Tester for a 12-month fixed-term contract. This is a senior technical role responsible for planning and delivering high-quality penetration testing and security assessment engagements across applications, infrastructure, cloud environments, networks, APIs, mobile platforms and emerging technologies. You will work with technical and business stakeholders to understand risk, define appropriate testing approaches and provide practical, evidence-based recommendations that strengthen security resilience.

Your responsibilities will include leading complex penetration tests from scoping and threat modelling through to exploitation, reporting and remediation support. You will identify and validate vulnerabilities, assess their potential business impact, and produce clear reports suitable for both technical and executive audiences. You will also provide mentoring and technical guidance to other testers, contribute to the development of testing methodologies and tooling, support quality assurance activities, and help improve the wider security assessment service. Where appropriate, you may represent the testing function in security reviews, risk discussions and remediation planning sessions.

Applicants should have substantial professional experience in penetration testing, red teaming or an equivalent offensive security role, together with a strong understanding of common attack techniques, security controls and vulnerability management. Demonstrable expertise in areas such as web application, API, network, cloud or Active Directory testing is required, along with the ability to script or automate tasks using languages such as Python, PowerShell or Bash. Industry-recognised certifications such as OSCP, CREST, GXPN, GPEN or equivalent are desirable. You will need excellent written and verbal communication skills, strong report-writing ability, sound judgement and a methodical approach to managing multiple engagements. The successful candidate must be comfortable working independently, handling sensitive information responsibly and collaborating effectively with colleagues and stakeholders at all levels.

We are seeking a Data & AI Security Engineer for a six-month fixed-term contract to help strengthen the security of data platforms, artificial intelligence solutions and analytics environments. This role will work across engineering, data, infrastructure and risk teams to identify security requirements, assess emerging threats and embed practical controls throughout the design, development and operation of data and AI services.

You will be responsible for defining and implementing security patterns for data ingestion, storage, processing and sharing, with a particular focus on cloud-based platforms and machine learning workloads. Key duties will include conducting threat modelling and risk assessments, reviewing architectures and code, supporting secure configuration and identity management, and developing controls for data classification, encryption, access management, secrets handling and monitoring. You will also assess AI-specific risks such as prompt injection, model misuse, data leakage, insecure model supply chains and adversarial manipulation. The role will contribute to security testing, vulnerability remediation, incident response, audit activity and the creation of clear technical standards and guidance.

The successful candidate will have practical experience in data security, cloud security, application security or a closely related engineering discipline, together with an understanding of modern data and AI technologies. Experience with platforms such as AWS, Azure or Google Cloud, data lakes and warehouses, APIs, containers, CI/CD pipelines and infrastructure as code would be valuable. You should be confident working with security frameworks and principles, including least privilege, secure-by-design development, privacy protection and risk-based decision-making. Strong communication skills are essential, as you will need to explain complex risks to both technical and non-technical stakeholders and influence teams to adopt effective solutions. Relevant certifications or experience in machine learning security, data protection or security engineering would be advantageous.

We are seeking a Data & AI Security Engineer to design, implement and continuously improve security controls across data platforms, artificial intelligence services and cloud environments. You will work closely with engineering, data science, infrastructure, privacy and risk teams to protect sensitive information, support secure innovation and ensure that data and AI solutions meet regulatory, legal and organisational requirements. This is an opportunity to help shape security architecture and establish practical safeguards across the full data and AI lifecycle.

Your responsibilities will include assessing risks in data pipelines, analytical platforms, machine learning systems and generative AI applications; developing security patterns for data ingestion, storage, processing and sharing; and implementing controls for identity and access management, encryption, secrets management, network security, monitoring and data loss prevention. You will contribute to threat modelling, secure design reviews, vulnerability assessments, incident response and investigations involving data or AI services. You will also help define governance for model usage, training data, prompt security, third-party AI tools, model integrity, output monitoring and the responsible handling of confidential information.

You will ideally have experience in data, cloud or application security, with practical knowledge of platforms such as AWS, Azure or Google Cloud and data technologies including warehouses, lakes, APIs and distributed processing environments. Familiarity with machine learning security, generative AI risks, privacy engineering, security frameworks and relevant regulations is highly desirable. Strong skills in scripting or automation, security testing, technical documentation and risk communication are important, along with the ability to work collaboratively with both technical and non-technical stakeholders. Professional security, cloud or data certifications are advantageous. The successful candidate will be analytical, pragmatic and curious, able to translate complex risks into effective controls while enabling teams to deliver trusted, resilient and secure data-driven products.

Application Security Engineer

We are seeking an experienced Application Security Engineer to help embed security throughout the software development lifecycle. You will work closely with engineering, architecture, DevOps and product teams to identify, assess and remediate security risks across web applications, APIs, cloud services and supporting infrastructure. The role will involve reviewing designs and technical requirements, conducting secure code reviews, supporting threat modelling, coordinating application penetration testing and helping teams apply secure-by-design principles from development through to production.

You will maintain and improve application security standards, guidelines and tooling, including software composition analysis, static and dynamic application security testing, secrets detection and vulnerability management platforms. Responsibilities will include triaging findings, validating vulnerabilities, prioritising remediation according to business risk, tracking issues through to resolution and producing clear reports for both technical and non-technical stakeholders. You will also contribute to security awareness initiatives, develop practical guidance for engineers, monitor emerging threats and support the continuous improvement of security processes, metrics and governance.

The successful candidate will have professional experience in application or product security, with a solid understanding of common web and API vulnerabilities, secure development practices and relevant frameworks such as OWASP Top 10 and OWASP ASVS. Experience with cloud environments, CI/CD pipelines, modern programming languages and security automation is highly desirable. You should be confident communicating with varied audiences, comfortable investigating complex technical issues and able to balance risk with delivery objectives. Relevant security qualifications or demonstrable hands-on experience are welcome. The role offers the opportunity to influence engineering practices, work on varied technology platforms and make a measurable contribution to the security and resilience of critical applications.

We are seeking an experienced Principal Penetration Tester for a 9-month fixed-term contract. This is a senior technical role for a security professional who can lead complex penetration testing engagements, provide expert advice, and help strengthen security across a diverse technology environment. You will work with technical and business stakeholders to assess risk, identify vulnerabilities, and communicate practical recommendations that support informed security decisions.

Your responsibilities will include planning and delivering penetration tests across web applications, APIs, mobile applications, networks, cloud environments, infrastructure, and other relevant platforms. You will define testing scope, select appropriate methodologies, conduct manual and tool-assisted assessments, safely validate vulnerabilities, and produce clear, evidence-based reports. You will present findings to both technical and non-technical audiences, explain potential business impact, agree remediation priorities, and support follow-up activities where required. You may also be expected to review third-party testing outputs, contribute to threat modelling and security architecture discussions, and assist with improving penetration testing processes, standards, and documentation.

Applicants should have substantial hands-on experience in penetration testing, ideally including responsibility for leading engagements or acting as a technical authority. Strong knowledge of common attack techniques, vulnerability assessment tools, secure development principles, and industry testing frameworks is essential. Experience with cloud technologies, modern web architectures, identity and access management, and scripting or programming languages would be advantageous. Relevant professional certifications such as CREST, OSCP, OSCE, GXPN, CHECK, or equivalent credentials are desirable. You will need excellent analytical, report-writing, and stakeholder-management skills, along with the ability to work independently, manage competing priorities, and deliver high-quality outcomes within agreed timescales.