Penetration Tester

REX Cyber Security; Greater London; On-site; GBP 70,000 - 100,000; Full time

Job summary

REX Cyber Security is seeking an experienced Cyber Security Consultant specialising in Penetration Testing to join its client-facing advisory team. The role is hands-on, with around 70% of time spent on testing across web apps, APIs and network infrastructure.

You will deliver assessments, provide remediation guidance, and contribute to wider cyber advisory engagements while developing expertise across cyber maturity, control reviews and security design.

Qualifications

• Hands-on penetration testing across web apps, APIs and networks.

Responsibilities

• Lead penetration testing engagements across web apps, APIs and networks.
• Define scope, objectives and rules of engagement with clients.
• Perform manual and tool-assisted testing using recognised methodologies (OWASP, PTES, MITRE ATT&CK).
• Deliver Cyber Essentials Plus assessments including scoping, testing and remediation verification.
• Produce high-quality technical reports with risk ratings and remediation suggestions.
• Present findings to technical and non-technical stakeholders.
• Support remediation and retesting.

Skills

API Security Testing

Manual penetration testing

Kali Linux

Burp Suite

Nmap

Qualys/Nessus

AD/Entra ID attack paths

Python/PowerShell/Bash

TCP/IP security

Windows/Linux security

Education

CREST CRT / OSCP / OSWE / CSTM

Tools

Kali Linux

Burp Suite

Nmap

Qualys

Nessus

Job description

We’re working with a leading global professional services company that is continuing to grow its Cyber Security capability and is looking for an experienced Cyber Security Consultant specialising in Penetration Testing to join its client-facing advisory team.

This is a predominantly hands-on technical role, with around 70% of your time focused on penetration testing and technical security assessments across a diverse portfolio of clients and industries.

You’ll deliver testing across web applications, APIs and internal/external network infrastructure, alongside Cyber Essentials Plus assessments, vulnerability assessments, cloud security reviews and configuration reviews.

Alongside the technical work, there is the opportunity to broaden your consulting experience across wider cyber security engagements, including cyber maturity assessments, security control reviews, audit readiness and security design advisory work.

The Role

You’ll work directly with clients to understand their environments, define testing requirements and deliver high-quality technical security assessments.

Rather than simply identifying vulnerabilities, you’ll be expected to safely validate weaknesses, understand their potential business impact and provide clients with clear, practical remediation advice.

The role offers a strong combination of hands-on offensive security and client-facing consulting, while giving you the opportunity to develop your expertise across a wider range of cyber security disciplines as the practice continues to grow.

Key Responsibilities

• Lead and support penetration testing across web applications, APIs and internal and external network infrastructure.
• Work directly with clients to define objectives, scope engagements and agree rules of engagement.
• Perform manual and tool-assisted testing aligned with recognised methodologies including OWASP, PTES and MITRE ATT&CK.
• Deliver Cyber Essentials Plus assessments, including scoping, technical testing, remediation verification and supporting clients through certification.
• Conduct vulnerability assessments, cloud security reviews and configuration/build reviews against CIS Benchmarks and vendor hardening guidance.
• Identify and safely validate security vulnerabilities and attack paths.
• Produce high-quality technical reports with clear risk ratings, business impact and practical remediation recommendations.
• Present findings to both technical and non-technical stakeholders.
• Support remediation and subsequent retesting.
• Contribute to wider cyber advisory engagements including risk assessments, security control reviews, audit readiness and security design.
• Build strong relationships with clients and contribute to proposals, scoping and the continued growth of the Cyber Security practice.
• Keep up to date with emerging threats, attack techniques and penetration testing methodologies.
• Contribute to the continued improvement of testing methodologies, tooling and technical capability.

Technical Experience

We’re looking for someone with strong hands-on experience across:

• API Security Testing
• Manual penetration testing techniques alongside automated tooling
• Kali Linux, Burp Suite and Nmap
• Vulnerability scanning platforms such as Qualys or Nessus
• Modern web architectures and common web/API vulnerabilities
• TCP/IP and network security
• Windows and Linux security
• Active Directory and Microsoft Entra ID attack paths
• Vulnerability assessments and configuration reviews
• Cyber Essentials and Cyber Essentials Plus
• Scripting and automation using Python, PowerShell, Bash or similar

You should also be comfortable managing technical engagements from initial scoping through to delivery, reporting, remediation advice and retesting.

About You

You’ll ideally have:

• Strong manual penetration testing capability and sound judgement around the use of automated tooling.
• Excellent written skills and experience producing clear, actionable technical reports.
• The ability to explain vulnerabilities, technical risk and potential business impact to both technical and non-technical audiences.
• Strong client and stakeholder management skills.
• A proactive, commercially aware approach to security consulting.
• The ability to work with organisations ranging from SMEs and scale-ups through to larger enterprise environments.

Experience or qualifications across any of the following would be beneficial:

• CREST CRT, OSCP, OSWE, CSTM or equivalent practical penetration testing certification.
• Mobile application or wireless penetration testing.
• Cloud penetration testing.
• Phishing or social engineering assessments.
• Systems hardening and implementation of technical security controls.
• Broader cyber advisory experience.
• ISO 27001, NIST or CIS Controls.

Why Join?

This is an excellent opportunity to join a growing Cyber Security practice within a leading global professional services company, working with a varied client base and tackling a wide range of real-world security challenges.

Crucially, penetration testing remains at the heart of the position. Around 70% of the role is dedicated to hands-on technical delivery, allowing you to continue developing your offensive security expertise rather than moving away from the technical work.

At the same time, you’ll have the opportunity to broaden your experience across Cyber Essentials Plus, vulnerability management, cloud security and wider cyber advisory engagements, giving you a clear path to develop into a more rounded senior security consultant.

For someone who enjoys hands-on penetration testing but wants greater client exposure, technical variety and long-term progression, this is a particularly strong opportunity.