AI Offensive Security Engineer - LLM & Penetration Testing

Xpand Group; Greater London; Híbrido; GBP 77 000 - 123 000; Tempo integral

Resumo da oferta

Xpand Group is seeking an AI Offensive Security Engineer to join a banking client in London. The role focuses on AI-assisted security testing across applications and infrastructure, combining traditional security testing with AI-powered automation and code analysis.

The position involves hands-on penetration testing, vulnerability validation and security automation within a hybrid London environment. The candidate will work with LLMs, AI agents, and security tools to enhance testing workflows,

Qualificações

• Minimum 3 years' experience in Application Security, Penetration Testing or Security Engineering.
• Strong hands-on experience with SAST, DAST, vulnerability assessments and penetration testing.
• Experience testing web applications, APIs and identifying common vulnerabilities.
• Practical experience using LLMs, Generative AI or AI agents for security analysis, coding, automation or testing.

Responsabilidades

• Perform application security assessments, penetration testing and vulnerability analysis using traditional and AI-assisted security tools.
• Execute SAST, DAST, web and API security assessments.
• Use LLMs and AI agents to support vulnerability identification, code analysis, test-case generation and automation.
• Configure AI models, prompts and testing workflows to improve effectiveness of security assessments.
• Conduct authorised offensive security testing in line with methodologies and rules of engagement.

Conhecimentos

Application Security

Penetration Testing

SAST/DAST

Python

AI/LLM tools

Ferramentas

Burp Suite

OWASP ZAP

Semgrep

Checkmarx

Fortify

Descrição da oferta de emprego

AI Offensive Security Engineer - LLM & Penetration Testing - BANKING CLIENT - LONDON

Location: London - Hybrid (8 days onsite per month)

Contract: 12 months (initial)

Day Rate: Competitive, depending on experience €500 - €800 per day

IR35 Status: Inside IR35 - MUST USE UMBRELLA

The Opportunity

We are looking for a hands-on AI Offensive Security Engineer to join the Offensive Security function of a leading global financial services organisation. This is an exciting opportunity to work at the intersection of Artificial Intelligence, Application Security and Ethical Hacking, helping to develop and operationalise AI-powered security testing capabilities. The organisation is investing in the use of Large Language Models (LLMs) and AI agents to enhance how security vulnerabilities are identified, assessed and validated across enterprise applications and infrastructure. You will work alongside experienced Offensive Security specialists, AI engineers and application development teams, using AI-assisted tools to support penetration testing, source-code analysis, vulnerability discovery and security automation. This is a practical, hands-on engineering role rather than a purely strategic or governance-focused position.

Key Responsibilities

AI-Assisted Offensive Security Testing

• Perform application security assessments, penetration testing and vulnerability analysis using traditional and AI-assisted security tools.
• Execute Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), web and API security assessments.
• Use LLMs and AI agents to support vulnerability identification, code analysis, test-case generation and security testing automation.
• Configure AI models, prompts and testing workflows to improve the effectiveness and efficiency of security assessments.
• Conduct authorised offensive security testing in accordance with established security methodologies and rules of engagement.

Vulnerability Analysis & Validation

• Investigate potential security vulnerabilities identified through automated and AI-assisted testing.
• Validate findings to distinguish genuine security weaknesses from false positives.
• Assess exploitability, attack paths, code reachability and potential business impact.
• Produce clear technical findings, supporting evidence and remediation recommendations.
• Collaborate with developers and security teams to address vulnerabilities and validate fixes.

Security Automation & Engineering

• Develop and maintain Python scripts and automation tools to support offensive security activities.
• Improve AI-assisted testing workflows, prompts, configurations and reusable testing scenarios.
• Support the integration of security testing capabilities into development environments and CI/CD pipelines.
• Work with cloud, containerised and enterprise application environments.
• Contribute to the development of repeatable, scalable and secure testing processes.

Operationalisation & Continuous Improvement

• Help transition AI-assisted offensive security capabilities from experimentation into an operational service.
• Develop technical documentation, testing procedures and reusable security-testing patterns.
• Evaluate the effectiveness, accuracy and reliability of AI-generated security findings.
• Collaborate with technical leads, security engineers and external providers to continuously improve testing capabilities.

Essential Skills & Experience

We are particularly interested in candidates who combine strong offensive security fundamentals with practical experience using AI or LLM technologies.

• Minimum 3 years' experience in Application Security, Penetration Testing, Offensive Security or Security Engineering.
• Strong hands-on experience with SAST, DAST, vulnerability assessments and penetration testing.
• Experience testing web applications, APIs and identifying common application security vulnerabilities.
• Practical experience using LLMs, Generative AI or AI agents for security analysis, coding, automation or technical testing.
• Ability to investigate vulnerabilities, validate exploitability and identify false positives.
• Good scripting or programming skills, ideally Python.
• Knowledge of security testing methodologies and frameworks, including OWASP, CWE, CVE and MITRE ATT&CK.
• Experience working with source code, Git, security-testing tools and technical documentation.
• Understanding of secure development practices and enterprise security controls.
• Strong communication skills, with the ability to explain technical vulnerabilities and remediation options.

Desirable Experience

• Experience with tools such as Burp Suite, OWASP ZAP, Semgrep, Checkmarx, Fortify or similar.
• Exposure to LLM frameworks, AI agents, prompt engineering or AI-powered security automation.
• Experience developing or integrating automated security-testing workflows.
• Knowledge of Azure, Docker, Kubernetes and cloud security.
• Experience integrating security tools into CI/CD pipelines.
• Familiarity with AI security threats, adversarial testing or MITRE ATLAS.
• Experience working within banking, financial services or other highly regulated environments.
• Relevant certifications such as OSCP, OSWE, CREST, CEH or equivalent.

If you have a strong background in Application Security or Penetration Testing and have been exploring how AI can improve security testing, we would be keen to hear from you.

*Rates depend on experience and client requirements