Cyber Threat Modeller & Penetration Tester

Lawrence Harvey; United Kingdom; Hybrid; GBP 80,000 - 100,000; Full time

Job summary

A leading recruitment firm is seeking a Cyber Threat Modeller & Penetration Tester for a hybrid/remote contracting role. You'll lead the threat modelling process, conduct penetration tests, and ensure secure SDLC practices. Ideal candidates will have experience with attack vectors and risk scenarios, alongside documentation skills using tools like Confluence and Jira. This opportunity initially spans until the end of 2025, with potential for extension.

Qualifications

• Experience leading threat modelling processes for security.
• Strong background in manual and automated penetration testing.
• Familiarity with secure SDLC practices and security compliance.

Responsibilities

• Lead the Threat Modelling process for products.
• Perform manual and automated penetration testing on applications.
• Define and enforce secure SDLC practices.
• Document vulnerabilities and risks for stakeholders.

Skills

Threat Modelling

Penetration Testing

SDLC Practices

Documentation

Tools

Confluence

Jira

Job description

Overview

My Client are looking for a Cyber Threat Modeller & Penetration Tester for an initial contract opportunity to start ASAP.

IR35 Status: Outside IR35
Rate: Negotiable
Location: Hybrid/Remote
Length: Initially until end of 2025 – with scope to extend

Responsibilities

• Lead the Threat Modelling process for new and existing products, identifying attack vectors, threat actors, and risk scenarios.
• Perform penetration testing (manual & automated) on applications, APIs, and infrastructure, prioritizing remediation with development teams.
• Define and enforce secure SDLC practices, supporting architecture and product design with security requirements.
• Partner with Delivery & Project Managers to plan and execute security sign–off gates (OWASP, NCA, 3rd party pentests).
• Support and maintain the Cybersecurity Go–Live Tracker, ensuring alignment between security tasks, releases, and backlog priorities.
• Document vulnerabilities, risks, and mitigations in Confluence, Jira, and security reports for stakeholders.
• Act as focal point for security assessments during release management, bug fixing cycles, and major product launches.
• Collaborate with external vendors (3rd party pentesters, compliance auditors) to coordinate IP whitelisting, credentials, and testing scope.

How to apply

If you are interested, please apply with your most up to date CV.

Lawrence Harvey is acting as an Employment Business in regards to this position.