AI Offensive Security Engineer – LLM & Penetration Testing - BANKING CLIENT - LONDON

Salt; Greater London; Hybrid; GBP 77,000 - 123,000; Full time

Job summary

Salt is seeking an AI Offensive Security Engineer in London to join the offensive security function of a leading financial services organization. Work at the intersection of AI, application security and ethical hacking to develop AI-powered security testing capabilities.

You will apply AI-assisted tools for penetration testing, source-code analysis, vulnerability discovery and automation, in a hands-on role with a practical engineering focus.

Qualifications

• Minimum 3 years' experience in Application Security, Penetration Testing or Security Engineering.
• Hands-on experience with SAST, DAST, vulnerability assessments and penetration testing.
• Experience testing web apps and APIs, identifying common vulnerabilities.
• Experience using LLMs/AI agents for security analysis, coding, automation or testing.
• Good scripting or programming skills, ideally Python.
• Knowledge of security testing frameworks (OWASP, CWE, CVE, MITRE ATT&CK).
• Experience with security tools and documenting findings.
• Understanding secure development practices and enterprise controls.
• Strong communication to explain vulnerabilities and remediation options.
• Experience in banking/regulated environments; OSCP/OSWE/CEH/CREST desirable.

Responsibilities

• Perform application security assessments and penetration testing using traditional and AI-assisted tools.
• Execute SAST, DAST, and web/API security assessments.
• Use LLMs/AI agents to support vulnerability identification, code analysis and test automation.
• Configure AI models, prompts and workflows to improve testing effectiveness.
• Conduct authorised offensive tests following established methodologies and rules of engagement.
• Investigate vulnerabilities, validate exploitability and assess business impact.
• Produce clear findings with evidence and remediation recommendations.
• Collaborate with developers and security teams to address fixes.
• Develop Python scripts and automation to support activities.
• Integrate security testing into CI/CD environments and cloud architectures.

Education

OSCP/OSWE/CEH/CREST certifications

Tools

Burp Suite

OWASP ZAP

Semgrep

Checkmarx

Fortify

Git

Python

Azure

Docker

Kubernetes

Job description

AI Offensive Security Engineer – LLM & Penetration Testing - BANKING CLIENT - LONDON

Location: London – Hybrid (8 days onsite per month)

Contract: 12 months (initial)

Day Rate: Competitive, depending on experience €500 - €800 per day

IR35 Status: Inside IR35 - MUST USE UMBRELLA

The Opportunity

We are looking for a hands-on AI Offensive Security Engineer to join the Offensive Security function of a leading global financial services organisation.

This is an exciting opportunity to work at the intersection of Artificial Intelligence, Application Security and Ethical Hacking, helping to develop and operationalise AI-powered security testing capabilities.

The organisation is investing in the use of Large Language Models (LLMs) and AI agents to enhance how security vulnerabilities are identified, assessed and validated across enterprise applications and infrastructure.

You will work alongside experienced Offensive Security specialists, AI engineers and application development teams, using AI-assisted tools to support penetration testing, source-code analysis, vulnerability discovery and security automation.

This is a practical, hands-on engineering role rather than a purely strategic or governance-focused position.

Key Responsibilities

AI-Assisted Offensive Security Testing

• Perform application security assessments, penetration testing and vulnerability analysis using traditional and AI-assisted security tools.
• Execute Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), web and API security assessments.
• Use LLMs and AI agents to support vulnerability identification, code analysis, test-case generation and security testing automation.
• Configure AI models, prompts and testing workflows to improve the effectiveness and efficiency of security assessments.
• Conduct authorised offensive security testing in accordance with established security methodologies and rules of engagement.

Vulnerability Analysis & Validation

• Investigate potential security vulnerabilities identified through automated and AI-assisted testing.
• Validate findings to distinguish genuine security weaknesses from false positives.
• Assess exploitability, attack paths, code reachability and potential business impact.
• Produce clear technical findings, supporting evidence and remediation recommendations.
• Collaborate with developers and security teams to address vulnerabilities and validate fixes.

Security Automation & Engineering

• Develop and maintain Python scripts and automation tools to support offensive security activities.
• Improve AI-assisted testing workflows, prompts, configurations and reusable testing scenarios.
• Support the integration of security testing capabilities into development environments and CI/CD pipelines.
• Work with cloud, containerised and enterprise application environments.
• Contribute to the development of repeatable, scalable and secure testing processes.

Operationalisation & Continuous Improvement

• Help transition AI-assisted offensive security capabilities from experimentation into an operational service.
• Develop technical documentation, testing procedures and reusable security-testing patterns.
• Evaluate the effectiveness, accuracy and reliability of AI-generated security findings.
• Collaborate with technical leads, security engineers and external providers to continuously improve testing capabilities.

We are particularly interested in candidates who combine strong offensive security fundamentals with practical experience using AI or LLM technologies.

• Minimum 3 years' experience in Application Security, Penetration Testing, Offensive Security or Security Engineering.
• Strong hands‑on experience with SAST, DAST, vulnerability assessments and penetration testing.
• Experience testing web applications, APIs and identifying common application security vulnerabilities.
• Practical experience using LLMs, Generative AI or AI agents for security analysis, coding, automation or technical testing.
• Ability to investigate vulnerabilities, validate exploitability and identify false positives.
• Good scripting or programming skills, ideally Python.
• Knowledge of security testing methodologies and frameworks, including OWASP, CWE, CVE and MITRE ATT&CK.
• Experience working with source code, Git, security‑testing tools and technical documentation.
• Understanding of secure development practices and enterprise security controls.
• Strong communication skills, with the ability to explain technical vulnerabilities and remediation options.
• Experience with tools such as Burp Suite, OWASP ZAP, Semgrep, Checkmarx, Fortify or similar.
• Exposure to LLM frameworks, AI agents, prompt engineering or AI‑powered security automation.
• Experience developing or integrating automated security‑testing workflows.
• Knowledge of Azure, Docker, Kubernetes and cloud security.
• Experience integrating security tools into CI/CD pipelines.
• Familiarity with AI security threats, adversarial testing or MITRE ATLAS.
• Experience working within banking, financial services or other highly regulated environments.
• Relevant certifications such as OSCP, OSWE, CREST, CEH or equivalent.

If you have a strong background in Application Security or Penetration Testing and have been exploring how AI can improve security testing, we would be keen to hear from you.