Penetration Tester

Hamilton Barnes ?; Greater London; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Hybrid working

Benefits package

Job summary

Hamilton Barnes is seeking a mid-level Security Testing Consultant in London to lead end-to-end penetration testing across web, infrastructure, cloud and API engagements. You will report findings to technical and executive audiences and guide remediation with a strong emphasis on quality and security outcomes.

The role offers hybrid working with UK client-site travel, a structured growth path toward AI security and red team capabilities, and opportunities to progress toward CREST/OSCP tracks.

Qualifications

• 3–5 years hands-on penetration testing experience.
• Web, infrastructure, cloud and API testing with OWASP focus.
• Ability to present findings to technical and executive audiences.

Responsibilities

• Conduct end-to-end penetration tests across web, cloud and infrastructure.
• Produce clear, structured reports and debrief clients.
• Provide remediation guidance and follow-up support.
• Help evolve in-house testing methodology and tooling.
• Support junior team members and stay updated on threats.

Skills

Penetration testing

Web application testing

Cloud security testing

API testing

Burp Suite

Nmap

Kali

Security reporting

Client communication

Team mentoring

Education

No degree required

Tools

Burp Suite

Nessus/Qualys

Metasploit

Nmap

Kali Linux

OWASP ZAP

Job description

A great opportunity for a mid-level Security Testing Consultant to join a London-based cybersecurity and AI risk consultancy operating to CREST methodology as an accredited CREST member company. You'll own delivery of your own engagements end-to-end (scoping, testing, reporting and client debriefs) across web, infrastructure, application and cloud testing, with API, mobile and wireless work as the project mix demands.

If you want a role that takes reporting and client communication as seriously as the testing itself, with a clear runway into AI security and red teaming, this is well worth a conversation.

Why this role stands out:

• A genuine, structured growth path: over your first 18–24 months, progress from core testing into AI security assessments, assumed breach exercises and red team operations, backed by a funded personal development plan toward OSCP, OSWE, OSEP, CRTO, CREST CCT and emerging AI security tracks
• Real client-facing ownership: present findings to technical and executive audiences and provide post-test remediation guidance as standard
• A collaborative team with experienced senior testers and an in‑house methodology you can help shape, plus hybrid working with some UK client‑site travel

• Conduct penetration tests across web applications, infrastructure, cloud environments and APIs, with mobile and wireless engagements as required
• Produce clear, well-structured reports and present findings to technical and executive client audiences
• Provide post-test remediation guidance and follow‑up support
• Contribute to the evolution of the in‑house testing methodology and tooling
• Support development of more junior team members
• Stay current with offensive security research, techniques and emerging threats
• Around 3–5 years of hands‑on penetration testing experience
• Web application testing aligned to OWASP WSTG, with hands‑on Burp Suite work
• Infrastructure and network testing, including Active Directory
• Cloud security testing in at least one of AWS, Azure or GCP (familiarity with a second helpful)
• API testing, including REST and ideally GraphQL
• Confident use of standard offensive tooling: Kali, Burp Suite, Nmap, a recognised vulnerability scanner (Nessus, Qualys or equivalent), Metasploit
• Working understanding of common application, network and cloud security controls, and how they fail
• One or more current accreditations from CREST (CPSA, CRT), Offensive Security (OSCP, OSWE) or equivalent
• Confident written English, as reporting is a substantial part of the role
• No degree required; demonstrable experience, certifications, lab work and research contributions weighed on their own merits
• Hybrid working
• Benefits package

Useful but not required:

• Programming in any mainstream language
• Containerisation and CI/CD security
• Red team or social engineering exposure
• Hands‑on AI/LLM security testing
• Hardware/IoT/ICS security
• Bug bounty or responsible disclosure work
• Mobile (OWASP MASTG) and wireless testing familiarity
• Annual gainshare bonus when company performance is above targetFunded personal development plan including certifications and conference attendance

#PenetrationTesting #SecurityTesting #CREST #OSCP #RedTeam #AISecurity #CyberSecurity #LondonJobs #InfoSecJobs