Penetration Tester

CodeWall; Greater London; Hybrid; GBP 65,000 - 90,000; Full time

Job summary

CodeWall, based in London, is seeking a hands-on Penetration Tester / Red Teamer for testing in customer environments. The role focuses on practical offensive security work, validating findings, and contributing to product improvements.

Mid-level experience is valued; practical ability matters more than certifications. You’ll deliver tests across applications, APIs, and infrastructure, support red-team exercises, and turn discoveries into scripts and repeatable test cases while communicating

Qualifications

• Hands-on penetration testing experience, ideally in an internal team or bug bounty programs.
• Ability to identify vulnerabilities manually, including auth weaknesses and injections.
• Comfort with web apps and APIs, infra or cloud testing is a plus.

Responsibilities

• Deliver penetration tests on customer applications, APIs and infrastructure with guidance.
• Support red-team exercises by analyzing attack paths and weaknesses.
• Validate agent-generated findings with manual testing to confirm reproducibility.
• Develop concise proofs of concept showing exploitability and impact.
• Write clear technical reports with evidence and remediation guidance.

Skills

Penetration testing

Red team / adversary emulation

Python scripting

Technical reporting

Tools

Burp Suite

Nmap

Job description

CodeWall | London | Hybrid, 3 days per week in the office

Find the weakness. Prove the impact. Help build agents that can do the same.

CodeWall is building autonomous offensive-security agents that find vulnerabilities and demonstrate how they can be exploited. We’re bringing together security researchers and engineers to change how organisations test and secure their systems.

We’re looking for a hands-on Penetration Tester / Red Teamer to run and support testing in customer environments, validate what our agents discover, and turn those findings into improvements across our product and research.

This is a mid-level role for someone who enjoys practical offensive-security work and wants to take on more responsibility alongside experienced researchers and engineers. Practical ability matters more than certifications.

You’ll work on real customer environments, investigate real vulnerabilities, and help answer a critical question: does this finding represent a security issue we can reproduce and prove?

Your work will include:

• Delivering penetration tests across customer applications, APIs and infrastructure, with support on more complex engagements.
• Supporting red-team exercises by investigating attack paths, testing weaknesses and contributing to exploitation.
• Validating agent-generated findings through manual testing, separating reproducible vulnerabilities from false positives.
• Developing clear proofs of concept that demonstrate exploitability, realistic impact and the conditions required for an attack.
• Writing concise technical reports with evidence and practical remediation guidance.
• Working with engineers to improve agent behaviour, testing coverage and the quality of findings.
• Turning useful discoveries into scripts, repeatable test cases and research inputs.
• Working carefully within agreed scopes, communicating clearly and exercising sound judgement in customer environments.

We’d like to hear from you if you have:

• Hands-on experience in penetration testing, an internal offensive-security team or substantive bug-bounty research.
• A solid understanding of common vulnerabilities and how to expose them manually, including access-control issues, authentication weaknesses and injection.
• Confidence investigating web applications and APIs, plus experience testing infrastructure or cloud environments.
• Familiarity with tools such as Burp Suite and Nmap, and the judgement to understand and challenge their results.
• The ability to write or adapt Python scripts to automate tasks and support testing.
• Clear written communication: you can explain what you found, how you reproduced it and why it matters.
• Curiosity, persistence and a willingness to ask for help when an unfamiliar problem needs a different approach.

Experience with Active Directory, privilege escalation, cloud security, adversary emulation or exploit development would be valuable. So would public research, useful tooling or technical write-ups. You don’t need experience in every area to apply.

Certifications such as OSCP are welcome, but they aren’t a requirement. We’re more interested in how you investigate a target, reason through a vulnerability and demonstrate its impact.

Previous AI experience isn’t required either; curiosity about how autonomous agents can support offensive-security work is.

At CodeWall, your testing will directly influence the product. You’ll work closely with people building the agents, see how your findings improve their capabilities, and develop your own skills through customer engagements and deeper technical investigation.

You’ll have meaningful responsibility in a small team, access to experienced offensive-security colleagues, and the opportunity to help shape how automated security testing works in practice.

If you have public tools, research or write-ups that show how you work, we’d love to see those too.