Penetration Tester

Oscar; Bristol; On-site; GBP 60,000 - 80,000; Full time

Benefits offered by this job

Funded certifications

Access to modern tooling

Performance-based incentives

Job summary

Oscar, a leading cyber security consultancy, is seeking an experienced Penetration Tester to join its Bristol team. You will plan and deliver tests across networks, systems and applications, and travel to client sites as required to assess security and provide actionable remediation guidance.

You will work with Metasploit, Burp Suite and Nmap, write client-ready reports, and present findings to technical teams and senior stakeholders.

Qualifications

• Degree in Computer Science, Cyber Security, Information Security or related discipline.

Responsibilities

• Planning and delivering penetration tests across networks, systems and applications, identifying vulnerabilities and security weaknesses

Skills

Penetration testing

Vulnerability assessment

Security testing

Report writing

Client communication

Independent work

Education

Bachelor's degree in Computer Science or Cyber Security

Tools

Metasploit

Burp Suite

Nmap

Job description

We're working with a well-established and highly regarded cyber security consultancy, known for delivering high-end penetration testing, vulnerability assessment and red teaming services to clients across critical sectors including telecoms, finance, defence, rail and aerospace. Their team has a strong track record of working on complex, high-stakes engagements ranging from national infrastructure projects through to global enterprise clients.

They're now looking to bring in an experienced Penetration Tester to join their growing technical team, based out of their Bristol office with regular travel to client sites.

What you'll be doing:

• Planning and delivering penetration tests across networks, systems and applications, identifying vulnerabilities and security weaknesses
• Carrying out detailed vulnerability assessments, security audits and risk analysis, producing clear reports with practical remediation guidance
• Working alongside the red team to run realistic attack simulations and evaluate client security controls
• Building and using exploitation tools to demonstrate real-world impact and help clients understand their risk exposure
• Writing well-structured, client-ready reports covering findings, risk ratings and recommended fixes
• Acting as a key point of contact for clients — scoping engagements, presenting results, and advising on how to strengthen their security posture
• Keeping up to date with emerging threats and testing techniques, and continually refining tools and methodology
• Taking on elements of project and client management as part of engagement delivery

Key skills and experience needed:

• A degree in Computer Science, Cyber Security, Information Security or a related discipline
• CHECK Team Member, CREST Registered Tester, or an equivalent recognised certification
• At least 2 years' hands‑on experience in penetration testing and vulnerability assessment
• Solid grounding in network protocols, operating systems and core security technologies
• Confident use of tools such as Metasploit, Burp Suite and Nmap
• Strong analytical and problem‑solving skills, with genuine curiosity about current threats and attack techniques
• Comfortable communicating technical findings clearly to both technical teams and senior stakeholders
• Able to work independently on client sites as well as collaboratively within a wider consulting team
• Confident presenting and delivering training where required

Beneificial (not essential):

• Code review experience
• Exposure to audit frameworks such as ISO 27001, CTAS or CAS(T)
• Experience mentoring or informally leading within a technical team

Why this role:

This is a genuine opportunity to work on varied, high-impact engagements across some of the most security-conscious sectors in the UK, rather than repetitive, low-value testing work. You'll be part of a collaborative technical team with real investment in your development — including funded certifications, access to modern tooling, and the chance to contribute to wider security research initiatives. Performance-based incentives sit on top of a competitive base salary.