Principal Penetration Tester

Addition; Watford; Hybrid; GBP 100,000 - 140,000; Full time

Benefits offered by this job

Hybrid working

Company bonus scheme

Matched pension contributions 8.5%

Private healthcare

Annual wellness allowance

Life days

Volunteering opportunities

Job summary

Addition is working with a large, highly regulated organisation on digital transformation and seeks a Principal Penetration Tester in Watford. Hybrid working, competitive salary with bonus and benefits.

You will lead testing across web apps, APIs and cloud environments (AWS) with a focus on Spring Boot microservices. Role involves threat-informed testing, purple team exercises, and coaching security colleagues for improved resilience.

Qualifications

• Hands-on penetration testing across web apps, APIs and service-based architectures.
• Deep Java/Spring Boot backend expertise.
• Experience with AWS-hosted apps and cloud security controls.
• Ability to communicate technical risks to technical and non-technical stakeholders.

Responsibilities

• Lead advanced penetration testing across web applications, APIs and backend services.
• Assess authentication, authorisation, session management, APIs, business logic and data flows.
• Review SAST/DAST findings and prioritise genuine risks for engineers.
• Translate architecture and threat models into practical testing strategies.
• Support release assurance with remediation guidance and risk metrics.
• Develop internal testing standards, playbooks and methodologies.
• Collaborate with external security partners to drive improvements.

Skills

Penetration testing

Web applications

APIs

Java / Spring Boot

AWS

Linux/Windows security

Threat modelling

MITRE ATT&CK

Education

CREST, OSCP, OSWE, OSEP certifications

Job description

We’re working with a large, highly regulated organisation undergoing significant digital transformation. They’re looking for a Principal Penetration Tester to strengthen their internal security testing capability, combining deep application security expertise with hands‑on offensive security and purple team work.

Role Overview:

• Location: Watford – Hybrid
• Package: Competitive salary + bonus & benefits
• Industry: Security / Technology

What You’ll Be Doing:

• Lead advanced penetration testing across web applications, APIs, backend services and connected platforms.
• Spend the majority of your time assessing application security across modern Java, Spring Boot and microservices environments.
• Test authentication, authorisation, session management, APIs, business logic and data flows to uncover vulnerabilities automated tooling may miss.
• Assess cloud-hosted and containerised applications, with a particular focus on AWS environments and application-level risk.
• Review SAST and DAST findings, cutting through false positives and helping engineering teams prioritise genuine security risks.
• Turn architecture and threat models into meaningful security testing strategies and practical test coverage.
• Support project and release assurance with clear recommendations around remediation, residual risk and security readiness.
• Help build and mature internal application security testing standards, playbooks and methodologies.
• Develop purple team exercises and adversary-informed testing alongside cyber defence teams.
• Explore realistic attack paths across Linux and Windows environments, including privilege escalation, exploit chaining and post-exploitation techniques.
• Apply MITRE ATT&CK principles to offensive testing scenarios and purple team exercises.
• Work with external security partners, turning assessment findings into measurable improvements to defensive capability.
• Act as a senior technical voice within the security function, coaching colleagues and improving the consistency and quality of testing.

Main Skills Needed:

• Strong hands‑on penetration testing experience across web applications, APIs and service‑based architectures.
• Deep understanding of Java backend environments, particularly Spring Boot, REST APIs and microservices.
• Experience assessing API gateways and Backend for Frontend architectures, including authentication, authorisation and data validation.
• Practical knowledge of AWS-hosted applications, containers and associated cloud security controls.
• Strong Linux and Windows security knowledge, including privilege escalation, credential risks and realistic exploitation techniques.
• Ability to perform manual security testing beyond automated scanning, particularly around business logic, attack chains and cross‑layer vulnerabilities.
• Working knowledge of binary exploitation or lower‑level vulnerability analysis.
• Strong understanding of modern web and mobile architectures, trust boundaries, sessions and data exposure risks.
• Experience developing security testing methodologies, standards or approaches rather than solely delivering individual assessments.
• Confident communicating technical vulnerabilities, business impact and remediation priorities to technical and non‑technical stakeholders.
• Exposure to secure code review, mobile testing, adversary emulation or purple teaming would be beneficial.
• Knowledge of EDR/AV evasion concepts, exploit development, WAF technologies or vulnerability research would be valuable.
• CREST, OSCP, OSWE, OSEP or comparable hands‑on experience would be advantageous.

What’s in It for You:

• Hybrid working with a Watford base.
• Company bonus scheme.
• Matched pension contributions of up to 8.5%.
• 26 days’ annual leave, two additional life days and bank holidays.
• Private healthcare and income protection.
• £500 annual wellness allowance.
• Enhanced maternity, paternity and adoption leave.
• Flexible benefits covering areas including EV schemes, dental and eye care, financial coaching and mortgage advice.
• Volunteering opportunities and matched funding.
• The chance to shape an internal offensive security capability rather than simply execute an established testing programme.
• A senior technical role within a large-scale transformation environment where security has genuine visibility and impact.

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.