CST Penetration Tester

Claranet; Leeds; On-site; GBP 55,000 - 85,000; Full time

Job summary

Claranet is seeking a CST Penetration Tester to join our Continuous Security Testing team. You will identify, validate and exploit vulnerabilities across customer external attack surfaces, combining automated scanning with hands-on manual testing and clear remediation guidance.

You will work directly with customers to explain risks, deliver reproduction steps and contribute to tooling and methodology improvements. This role emphasizes practical impact and proactive security testing practices.

Qualifications

• Hands-on experience identifying, validating and exploiting security vulnerabilities.
• Ability to discuss risks and remediation with customers.
• Experience delivering practical remediation guidance.

Responsibilities

• Deliver continuous security testing across customer environments, combining automated scanning with in-depth manual assessment.
• Monitor customers' external attack surfaces for changes and new targets.
• Manually identify, verify and exploit vulnerabilities to establish real-world impact.
• Validate automated scanner findings and investigate false positives.
• Produce proof-of-concept, reproduction steps and remediation recommendations.
• Communicate findings clearly to customers via notifications and reports.
• Onboard customers into the testing service and configure ongoing scanning.
• Research emerging vulnerabilities and tooling to improve testing capabilities.

Skills

Penetration testing

Vulnerability assessment

Customer communication

Threat modelling

Tools

Burp Suite Professional

SQLMap

Job description

We're looking for a CST Penetration Tester to join our Continuous Security Testing team, helping customers identify, understand and remediate vulnerabilities across their external attack surface.

Unlike traditional point-in-time penetration testing, our Continuous Security Testing service combines automated vulnerability scanning with hands-on manual testing throughout an ongoing engagement. You'll investigate vulnerabilities, validate scanner findings, identify issues that automation alone cannot detect and determine their real-world impact through manual exploitation.

You'll work directly with customers to clearly communicate risks and remediation, while also contributing to the continued development of our security testing capabilities, tooling and methodology.

What you'll be doing

• Deliver continuous security testing across customer environments, combining automated scanning with in-depth manual assessment.
• Monitor customers' external attack surfaces for changes, emerging vulnerabilities and new targets.
• Manually identify, verify and exploit vulnerabilities to establish their genuine impact.
• Validate automated scanner findings and investigate potential false positives and areas requiring deeper assessment.
• Chain vulnerabilities and findings where appropriate to demonstrate realistic attack paths and risk.
• Produce clear proof-of-concepts, reproduction steps and remediation recommendations for identified vulnerabilities.
• Communicate technical findings clearly and professionally to customers through vulnerability notifications, reporting and regular updates.
• Support pre-engagement activities, including scoping assessments, understanding customer requirements and contributing to statements of work.
• Onboard customers into the Continuous Security Testing service and configure ongoing vulnerability scanning.
• Research emerging vulnerabilities, techniques and tooling to continually improve our testing capabilities.
• Develop or enhance internal security testing tools and contribute to improvements across our processes and systems.

What we're looking for

You'll have a strong foundation in penetration testing and vulnerability assessment, with the ability to go beyond automated tooling and investigate how vulnerabilities could be exploited within real-world environments.

You'll be comfortable working independently on technical assessments while also engaging directly with customers to explain vulnerabilities, their potential impact and appropriate remediation.

Technical skills

You'll have a strong understanding of:

• Networking fundamentals including TCP/IP, HTTP, DNS, SMB, SMTP and the OSI model.
• Microsoft Windows environments and at least one Linux distribution.
• Web application technologies and security testing.
• REST and SOAP APIs, including XML and JSON.
• Identifying and exploiting web application vulnerabilities beyond simply testing against the OWASP Top 10.
• Penetration testing and assessment tools such as Burp Suite Professional and SQLMap.
• Internal and external infrastructure security testing.
• Identifying and exploiting vulnerabilities and misconfigurations across technologies such as Windows domains, Linux servers, databases, virtualisation platforms and network infrastructure.

You'll also have experience with at least one scripting language, ideally Python, although experience with PowerShell, Bash or Ruby would also be valuable.

Experience we're looking for

• Hands-on experience identifying, validating and exploiting security vulnerabilities.
• Experience providing practical and proportionate remediation advice.
• Strong technical report writing skills, with the ability to clearly explain vulnerabilities, impact and remediation.
• A proactive mindset and genuine interest in developing your penetration testing capabilities.

Certifications

The following certifications, or equivalent recognised security qualifications, would be highly desirable:

• CPSA
• CRT
• OSCP

Experience conducting security assessments within cloud environments would also be advantageous.