Cyber Security Penetration Testing Consultant

Accenture PLC; Greater London; Hybrid; GBP 65,000 - 95,000; Full time

Job summary

Accenture PLC is seeking a Cyber Security Penetration Testing Consultant to deliver hands-on security testing of client web applications, APIs and infrastructure across the UK. The role works within a collaborative testing team, supported by senior testers, with CHECK and/or Red Team workstreams as a development path.

You will help clients understand risks and remediation in a practical, business-facing way.

Qualifications

• :// Must contain valid evidence from HTML, condensed for job ad requirements
• -

Responsibilities

• Perform manual and tool-assisted testing of web applications, APIs and infrastructure.
• Identify and validate vulnerabilities within engagement rules of engagement.
• Explain business impact of attack paths and provide remediation guidance.
• Write clear reports with evidence, risk ratings and prioritized remediation.
• Support remediation and conduct retests to verify fixes.
• Escalate critical findings and communicate impact to stakeholders.
• Share knowledge through peer reviews and tooling improvements.

Skills

Penetration testing

OWASP Top 10

Technical writing

Networking basics

Windows & Linux security

Team collaboration

Education

Certification track (CREST CRT/CSTM)

Tools

Burp Suite

Nmap

Metasploit

Job description

Job Title: Cyber Security Penetration Testing Consultant

Locations: UK wide (hybrid work- 1x a month in office)

Salary: Competitive salary and package (Depending on level of experience)

Please Note:Any offer of employment is subject to satisfactory BPSS and SC security clearance which requires 5 years continuous UK address history (typically including no periods of 30 consecutive days or more spent outside of the UK) at the point of application.

Role overview

As a Penetration Tester, you will deliver hands-on security testing of client web applications, APIs and infrastructure. Working within a collaborative testing team, and supported by senior testers and CHECK Team Leaders on complex engagements, you will find and validate vulnerabilities, demonstrate their real-world impact and give clients clear, practical remediation advice. This role suits a tester who wants to broaden their technical skills and progress through recognised industry certifications, and work towards delivery of CHECK and/or Red Team assessments.

Key responsibilities

• Perform manual and tool-assisted testing of web applications, APIs and internal and external infrastructure.
• Identify, validate and safely exploit vulnerabilities within agreed rules of engagement, including authentication, authorisation, injection, business logic and misconfiguration issues.
• Help identify attack paths, including privilege escalation, and explain their business impact.
• Follow recognised methodologies, including OWASP (WSTG, API Security Top 10), PTES and CHECK/CREST standards.
• Help prepare for engagements by confirming scope, access and prerequisites with the engagement lead.
• Write clear, accurate reports with reproducible evidence, risk ratings and prioritised remediation advice.
• Support client remediation and carry out retests to confirm fixes are effective.
• Escalate critical findings promptly to the engagement lead and help explain their impact to stakeholders.
• Share knowledge with the team through peer review, tooling improvements and technical write-ups.

Essential skills and experience

• Typically 2-4 years' commercial penetration testing experience across web applications, APIs and infrastructure.
• Holds, or is working towards, a practitioner-level certification such as CREST CRT, Cyber Scheme CSTM, OSCP.
• Good working knowledge of common web and API vulnerabilities, including the OWASP Top 10 and API Security Top 10.
• Sound understanding of networking, common protocols, and Windows and Linux security.
• Practical experience with industry-standard tools such as Burp Suite, Nmap and Metasploit.
• Ability to validate findings, rule out false positives and capture reproducible evidence.
• Clear technical writing that explains risk and remediation in plain language.

Desirable skills and experience

• Awareness of cloud security and configuration review in AWS, Azure or GCP.
• Some mobile application testing experience (iOS and/or Android).
• Basic scripting (e.g. Python, Bash, PowerShell) to automate tasks or adapt tools.
• Understanding of cryptography and build/hardening standards.
• A curious mindset, shown through CTFs, home labs, bug bounty, CVEs or technical blog posts.
• Holds, or is eligible for, UK security clearance for CHECK and public sector work.

Development and support

• Mentoring and technical guidance from experienced testers and CHECK Team Leaders.
• A funded certification pathway, for example from CRT or CSTM through to CCT or CSTL.
• A broad mix of engagements to build experience across testing types.
• Dedicated time for training, research and lab work.
• Opportunities to contribute to internal tooling, methodology and innovation projects.

#LI-EU #LI-MP