Penetration Tester & AI Security Engineer

Javelin Global Commodities

City of Westminster

On-site

GBP 70,000 - 120,000

Full time

5 days ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Annual discretionary bonus

25 days holiday

Company pension scheme (10% company)

Private medical scheme

Travel insurance

Income protection

Life insurance (5x salary)

Bike2Work scheme

Season ticket loan

Onsite gym

Job summary

Javelin Global Commodities in London seeks a Penetration Tester & AI Security Engineer to join the Infrastructure team. You will identify vulnerabilities across infrastructure, applications and AI-enabled solutions, and work with cross-functional teams to remediate and strengthen security controls.

The role combines traditional penetration testing with AI security testing, secure AI development and client-facing security assessments. Full-time, based in the London office near Victoria.

Qualifications

Proven experience in penetration testing across infrastructure, web apps, APIs and cloud.
Strong knowledge of AD, Entra ID, M365, Azure and AWS.
Experience with security tools and secure development principles.
Understanding of AI security, prompt-injection testing and AI red teaming.

Responsibilities

Conduct penetration testing across infrastructure, apps, networks and cloud environments.
Identify vulnerabilities and work with teams to remediate and retest.
Perform authorised security testing of new client platforms and integrations.
Support secure development of in-house AI solutions and AI agents.
Ensure AI solutions follow security, privacy and access-control requirements.
Test AI security controls including prompt injection and data leakage.
Produce clear findings and actionable remediation recommendations.

Skills

Penetration testing

Security engineering

AI security

Cloud environments

Active Directory

PowerShell/Python

Tools

Burp Suite

OAuth/OIDC

REST APIs

Copilot Studio/Azure AI

Azure/AWS

Microsoft Entra ID

Microsoft 365

Job description

About Javelin

Javelin Global Commodities is a leading global commodities marketing, trading, logistics services and investment firm with head offices in London and wider global offices in New York, Dallas, San Diego, St Louis, Canada, Switzerland, Poland, Dubai, India, Singapore, China and Australia. Javelin was founded in 2015 and now operates across six continents with respect to more than 20 different commodities across thermal coal, metallurgical coal, iron ore, steel scrap, metals, hydrocarbons, freight, softs, and renewables.

Established in 2015, Javelin employs over 200 people and is a unique place to grow your career. We take pride in our values, global reach, meritocratic culture and strong work ethic. Our success over the years has been built on our guiding principles of customer service, creativity, transparency, integrity, and responsibility.

Whilst our footprint grows, we still foster a small-company atmosphere. We have a flat company structure and encourage collaboration across all seniority levels, teams and locations to generate the best ideas. Javelin has a dedicated strategy to support local and meaningful charities through volunteer days, donation matching, a ‘give as you earn’ scheme and other fundraising activities. We are committed to the wellbeing of our colleagues and organise various social evenings, sports clubs and lunchtime activities. Our London office has on-site gym facilities and a golf/sports simulator. Discover more at http://www.javelincommodities.com/.

The Role

Javelin is looking for a Penetration Tester & AI Security Engineer to join our London Infrastructure team, responsible for identifying and validating security weaknesses across Javelin’s infrastructure, applications and emerging AI capabilities. This is a new role that combines traditional penetration testing with AI security testing, secure AI development and the security assessment of new client-facing solutions. The individual will work closely with Infrastructure, development teams, business stakeholders and external security partners to identify vulnerabilities, demonstrate their potential impact and support their remediation. A key part of the role will be helping Javelin adopt AI technologies securely, including developing approved in-house AI solutions, testing AI security controls, conducting AI red-team exercises and ensuring AI applications and agents operate within clearly defined security and data-access boundaries. There will also be the opportunity to support new client engagements by performing authorised security testing of new platforms, applications and integrations, helping ensure security is built in from initial design through to production. The role is based full time in Javelin’s London office, a short walk from Victoria train and bus station.

Key Responsibilities Include:

Conduct penetration testing across Javelin’s infrastructure, applications, networks, Active Directory and cloud environments.

Identify vulnerabilities, demonstrate their potential impact and work with Infrastructure teams on remediation and retesting.

Perform authorised security testing of new client-facing platforms, applications and integrations before they go live, and provide security sign-off recommendations.

Support the secure development of in-house AI solutions, including AI agents, automation and integrations, using Microsoft Copilot Studio, Azure AI services and other approved platforms.

Ensure AI solutions follow Javelin’s security, privacy, access-control and data-protection requirements.

Test AI security controls, including prompt injection, data leakage, excessive permissions and attempts to bypass AI guardrails.
Conduct controlled AI red-team testing to identify weaknesses in AI applications and agents.
Test that AI systems respect existing user permissions and cannot expose confidential Javelin or client information.
Review AI identities, API permissions and access to systems such as Microsoft 365, Azure and corporate data.
Help develop Javelin’s standards for secure AI development, testing and deployment, and produce clear technical findings and management-level reporting with practical recommendations for remediation.

Skills and Experience Required

Proven experience in penetration testing across infrastructure, web applications, APIs and cloud environments

Strong knowledge of Active Directory, Microsoft Entra ID, Microsoft 365, Azure and AWS, as well as networking and Windows/Linux

Experience with application security tools and concepts such as Burp Suite, OAuth/OIDC, REST APIs and secure development principles

Understanding of AI and large language model security, including prompt-injection testing, AI red teaming, data-leakage and access-control testing, and OWASP AI security guidance