Penetration Tester

Ocho; Belfast City District; Hybrid; GBP 40,000 - 50,000; Full time

Benefits offered by this job

Private medical insurance

Pension matching up to 8%

Life assurance at 4x salary

25 days’ annual leave + bank holidays

Job summary

Ocho, based in Belfast with hybrid work (2 days on site), is hiring a hands-on Penetration Tester to assess web apps, APIs and systems for a global law firm. You’ll perform manual testing, focusing on live applications, including AI-enabled components, using Burp Suite and Kali Linux with OWASP methodologies.

Expect a mix of on-site and remote collaboration, and a focus on practical, actionable findings. The role emphasizes independent testing, clear reporting, and contributing to capacity

Qualifications

• Hands-on penetration testing experience is essential.
• Strong manual testing of web apps and APIs required.
• Experience with vulnerability assessment vs. pen-testing understood.

Responsibilities

• Deliver hands-on pen tests across web apps, APIs, and systems.
• Perform manual testing of live apps using OWASP methods.
• Test REST and GraphQL APIs and their auth controls.
• Identify, validate and exploit vulnerabilities; confirm findings.
• Write clear, actionable reports for technical and non-technical audiences.
• Contribute to architecture reviews and backlog clearing.

Skills

Hands-on testing

Burp Suite

Kali Linux

OWASP Top 10

CVEs & exploitation

API testing REST/GraphQL

Report writing

Ability to explain findings

Education

OSCP (advantage)

GIAC certifications (nice-to-have)

Security testing certifications

Tools

Nessus

AppScan

Nipper

Metasploit

Wireshark

Job description

A hands-on penetration testing role delivering web application, API and systems assessments for a global law firm, based in Belfast with 2 days a week on site, paying £40,000 to £50,000.

About the Company

Our client is a global law firm making a major investment in cyber security and AI. They are creating three new Penetration Tester roles to increase testing capacity, clear existing backlogs and help secure the firm’s applications, platforms, systems and new AI-enabled solutions.

The Role

You will join the in‑house penetration testing team and deliver assessments independently, with much of your time spent on manual testing of live web applications and APIs. This is a hands‑on technical role where your testing ability matters far more than polish. As the firm’s AI adoption grows, you will also help assess the security of AI‑enabled applications and agents. Offensive, hands‑on experience from any sector is welcome, whether that is consultancy, financial services, tech, government, defence or elsewhere.

Key Responsibilities

• Deliver hands‑on penetration tests across the firm’s applications, platforms and systems, working independently.
• Carry out manual web application testing against live applications using OWASP-based methodologies.
• Test APIs, including REST and GraphQL services and their authentication and authorisation controls.
• Identify, validate and exploit vulnerabilities, accurately confirming which findings are real.
• Write clear reports with practical, actionable recommendations for technical and non‑technical audiences.
• Contribute to application architecture reviews.
• Help assess the security of AI‑enabled applications and agents as the firm’s use of AI grows.
• Work with the team to clear the existing testing backlog and increase testing capacity.

What You’ll Need

• Hands‑on penetration testing, including significant manual web application testing, is essential, and the single most important thing we are looking for.
• Strong hands‑on use of Burp Suite and Kali Linux is essential.
• Solid knowledge of the OWASP Top 10, CVEs and exploitation techniques is essential.
• A clear understanding of how a vulnerability assessment differs from a penetration test is essential.
• The ability to write clear reports and explain technical findings to non‑technical colleagues is essential.
• API testing experience across REST, GraphQL, authentication and authorisation is highly advantageous.
• Experience of application architecture reviews is highly advantageous.
• Experience testing AI‑enabled applications or agents, or using AI to support your testing, is a strong advantage.
• OSCP is a strong advantage, though practical testing experience counts for more than certifications alone.
• Experience with Nessus, AppScan, Nipper, Metasploit or Wireshark is desirable.
• CISSP, GPEN, GWAPT, GAIPT, CEH or other GIAC certifications are desirable.

Why Apply?

• Join one of three new roles created as part of a major investment in cyber security and AI.
• Focus on hands‑on technical testing, where your ability is valued above polish.
• Work on the security of AI‑enabled applications and agents, an area few testing roles offer.
• Hybrid working in Belfast, 2 days a week on site, with all formal interview stages available virtually.
• A salary of £40,000 to £50,000, plus private medical insurance, pension matching up to 8% and life assurance at 4x salary.
• 25 days’ annual leave plus bank holidays, rising to 28 days.
• A clear two‑stage process, including time with the Chief Security Officer.

Note For Applicants

All candidates must be currently residing in NI and have full UK Right to Work. Visa Sponsorship for this role is not provided.