Penetration Tester

10Nex Consultancy; Greater London; Hybrid; GBP 70,000 - 95,000; Full time

Benefits offered by this job

Hybrid work model

Funding for certifications

Training and conference attendance

Job summary

10Nex Consultancy in London is seeking a Security Testing Consultant to join a growing cybersecurity team. You'll perform penetration testing across web apps, infrastructure, cloud, and APIs, with opportunities to explore mobile, red teaming, and emerging security areas.

You'll own testing engagements, write clear reports, present findings to clients, and help remediation. A few years of hands-on pentesting is ideal, with certifications like CREST CPSA/CRT, OSCP, OSWE preferred.

Qualifications

• 3–5 years of hands-on pen testing experience.
• Experience across web apps, infrastructure, cloud and API testing.
• OWASP and Burp Suite familiarity.
• Certifications such as CREST CPSA/CRT, OSCP or OSWE are a plus.
• No degree required; focus on skills and deliverables.

Responsibilities

• Penetration testing across web apps, infrastructure, cloud and APIs
• Working with Active Directory and network environments
• Testing across AWS, Azure and/or GCP
• Using tools such as Burp Suite, Kali Linux, Nmap, vulnerability scanners and Metasploit
• Taking ownership of your own testing engagements
• Writing clear reports and talking clients through your findings
• Helping clients understand how vulnerabilities can actually be remediated
• Contributing ideas around testing approaches, tooling and methodology
• Sharing knowledge with other members of the team

Skills

Penetration testing

Security testing

Report writing

Team collaboration

Tools

Burp Suite

Kali Linux

Nmap

Metasploit

Vulnerability scanners

Job description

London | Hybrid | Permanent | Competitive Salary + Bonus

I'm working with a growing cybersecurity business in London that's looking to add a Security Testing Consultant to its team.

This is a good one for someone who already has a few years of penetration testing experience under their belt and wants to keep progressing technically.

The work is varied. You'll be testing across web applications, infrastructure, cloud environments and APIs, rather than being boxed into one particular area. There'll also be opportunities to get involved in things like mobile, wireless, red teaming and newer areas of security as you develop.

What you'll be doing

• Penetration testing across web apps, infrastructure, cloud and APIs
• Working with Active Directory and network environments
• Testing across AWS, Azure and/or GCP
• Using tools such as Burp Suite, Kali Linux, Nmap, vulnerability scanners and Metasploit
• Taking ownership of your own testing engagements
• Writing clear reports and talking clients through your findings
• Helping clients understand how vulnerabilities can actually be remediated
• Contributing ideas around testing approaches, tooling and methodology
• Sharing knowledge with other members of the team

What I'm looking for

You’ll ideally have around 3-5 years of hands-on penetration testing experience.

You don't need to tick every box, but experience across a good mix of the below would be ideal:

• Web application penetration testing
• OWASP / Burp Suite
• Infrastructure and network testing
• Cloud security testing
• API testing
• Kali Linux

If you've got certifications such as CREST CPSA / CRT, OSCP, OSWE or something similar, even better.

There's no degree requirement for this role. They're much more interested in what you can actually do technically and the experience you've built up.

Not essential, but any exposure to the following would be a bonus

• CI/CD security
• Red teaming
• Social engineering
• AI / LLM security
• Mobile security
• IoT / hardware security
• Bug bounty or responsible disclosure work

Why it's worth considering

The main attraction here is the progression.

They're happy to invest in people technically, including funded certifications, training and conference attendance, and there's scope to move into more advanced areas of offensive security as you grow.

That could include:

• Red team engagements
• Assumed breach testing
• AI security
• More advanced application and infrastructure testing

You’ll still be hands-on day to day, but you're joining somewhere that gives you room to develop rather than just putting more and more standard penetration tests in your diary.

If you're a penetration tester in or around London and fancy hearing a bit more about it.