Cyber Security Consultant (Penetration Tester)

Moore Kingston Smith LLP; Greater London; On-site; GBP 45,000 - 55,000; Full time

Job summary

Moore Kingston Smith LLP in London is seeking an experienced Cyber Security Consultant specialising in penetration testing to join our client-facing advisory team. You will deliver hands-on testing across web applications, APIs, and network infrastructure, and support Cyber Essentials Plus assessments.

You will apply recognised methodologies, produce high-quality deliverables, and explain risks to both technical and non-technical stakeholders while developing strong client relationships and

Qualifications

• Experience delivering client-facing penetration tests across web apps, APIs, and networks.
• Strong manual testing with automation tools and practical tooling experience.
• Scripting in Python, PowerShell, Bash or similar language.
• Knowledge of modern web architecture, vulnerabilities, TCP/IP, Windows and Linux security.
• Experience delivering vulnerability assessments and CIS benchmark reviews.
• Knowledge of Cyber Essentials/Cyber Essentials Plus schemes.
• Ability to manage engagements within scope, timescales and budgets.
• Strong written and verbal communication for technical and non-technical stakeholders.
• Proactive client-facing mindset with ability to grow advisory services.

Responsibilities

• Lead and support penetration testing engagements across web apps, APIs, and networks.
• Define objectives, scope and rules of engagement with clients; plan testing.
• Apply manual and tool-assisted testing aligned with OWASP PTES, MITRE ATT&CK.
• Deliver Cyber Essentials Plus assessments and remediation guidance for clients.
• Deliver wider technical security assessments including vulnerability and cloud reviews.
• Produce clear deliverables and present findings to stakeholders with risk ratings.
• Support advisory engagements like risk assessments, control reviews and audits.
• Build client relationships and contribute to proposals and business development.
• Maintain knowledge of threat landscape and continuously improve methodologies.

Skills

Penetration testing

Manual testing

Kali Linux

Burp Suite

Nmap

Qualys/Nessus

Python scripting

AD attack paths

Windows security

Documentation

Tools

Kali Linux

Burp Suite

Nmap

Qualys

Nessus

Python

Job description

Cyber Security Consultant (Penetration Tester)

Department: Cyber

Employment Type: Permanent - Full Time

Location: City, London

Compensation: £45,000 - £55,000 / year

Description

Moore Kingston Smith is seeking an experienced Cyber Security Consultant specialising in penetration testing to join our client-facing advisory team. You will join an NCSC-recognised cyber security team within our Risk Advisory practice, supporting a diverse portfolio of clients across multiple sectors.

This is a hands‑on role focused on delivering penetration tests across web applications, APIs, and internal and external network infrastructure. You will also support Cyber Essentials Plus assessments and wider technical security reviews, including vulnerability assessments, configuration reviews against recognised benchmarks, and cloud security reviews. You will identify and safely validate security weaknesses, explain the associated business risks clearly, and provide practical remediation advice tailored to each client.

Technical delivery will account for at least 70% of the role and will remain the core focus. Depending on your experience, interests and business requirements, there may also be opportunities to contribute to broader cyber security engagements, including cyber maturity assessments, security control reviews, audit readiness activities and security design advisory work. Typically, this would represent up to 30% of your time and provides an opportunity to broaden your consulting expertise while supporting clients across a wider range of security challenges.

We are looking for a proactive consultant with strong technical fundamentals, sound professional judgement and a genuine interest in helping clients improve their security posture. This role offers the opportunity to deepen your offensive security expertise while contributing to the continued growth of a collaborative and commercially focused cyber security practice.

Key Responsibilities

• Lead and support penetration testing engagements across web applications, APIs, and internal and external network infrastructure.
• Work with clients to define objectives, agree scope and rules of engagement, and plan testing that meets their assurance needs.
• Apply manual and tool‑assisted testing techniques aligned with recognised methodologies and frameworks, including the OWASP Web Security Testing Guide, PTES, and MITRE ATT&CK.
• Deliver Cyber Essentials Plus assessments, including scoping, conducting the required technical tests, verifying remediation and supporting clients through to certification in line with current NCSC and IASME scheme requirements.
• Deliver wider technical security assessments, including vulnerability assessments, cloud security reviews, and build and configuration reviews against CIS Benchmarks and vendor hardening guidance.
• Produce clear, high‑quality deliverables and present findings to technical and non‑technical stakeholders. Apply appropriate risk ratings, explain business impact, and support clients with remediation and retesting.
• Support general advisory engagements such as cyber risk assessments, security control reviews, audit readiness, remediation planning and security design advice.
• Build strong client relationships and contribute to business development, supporting proposals, scoping, tenders and thought leadership, and identifying opportunities to expand our services.
• Maintain current knowledge of the threat landscape, emerging attack techniques, testing methodologies, and scheme requirements, while contributing to peer review and quality assurance.
• Contribute to the continuous improvement of our methodologies, tooling, delivery processes, and technical capability.

Skills, Knowledge and Expertise

Essential

• Professional experience delivering client‑facing penetration tests across web applications, APIs, and internal or external network infrastructure, independently and/or as part of a team.
• Strong manual testing capability and sound judgement in selecting and using automated tools, with practical experience of Kali Linux, Burp Suite, Nmap, and Qualys or Nessus.
• Familiarity with recognised penetration testing methodologies and frameworks, together with the ability to script or automate tasks using Python, PowerShell, Bash, or a comparable language.
• Good knowledge of modern web architecture, common web and API vulnerabilities, TCP/IP, Windows and Linux security, and Active Directory and Microsoft Entra ID attack paths.
• Experience delivering, or the ability to deliver, wider technical assessments such as vulnerability assessments and configuration reviews against recognised benchmarks such as CIS.
• Working knowledge of the Cyber Essentials and Cyber Essentials Plus schemes. Existing assessor experience is beneficial; appropriate training will be provided where required.
• Ability to manage engagements within agreed scope, rules of engagement, timescales, budget, and quality standards, while maintaining clear testing evidence and protecting client systems and data.
• Strong written communication skills, including the ability to produce clear, accurate, and actionable technical reports.
• Strong verbal communication and stakeholder‑management skills, with the ability to explain technical findings, risk, and business impact to technical and non‑technical audiences.
• A proactive, client‑oriented mindset and a commitment to continuous learning, confident working with clients ranging from SMEs and scale‑ups to larger enterprises.

Desirable

• A recognised practical penetration testing certification, such as CREST CRT, OSCP, OSWE, CSTM or an equivalent qualification.
• Experience in additional testing disciplines such as mobile application, wireless or cloud penetration testing, or phishing and social‑engineering assessments.
• Experience with public cloud and SaaS platforms such as AWS, Azure, GCP or Microsoft 365, or hands‑on security or IT engineering experience such as hardening systems and implementing technical controls.
• An interest in, or experience of, broader advisory work such as cyber risk assessments, security control reviews, audit readiness, or working knowledge of a recognised framework such as ISO/IEC 27001, NIST, or CIS Controls.

Benefits