Security Engineer: Penetration Testing & Offense

Nationwide; Greater London; Hybrid; GBP 70,000 - 95,000; Full time

Benefits offered by this job

25 days holiday

Private medical insurance

Pension scheme

Annual performance bonus

Training and development

Salary sacrifice options

Life assurance

WellHub health & wellness

Volunteering days

Job summary

Nationwide is seeking a Penetration Testing Engineer to conduct security assessments across our estate and advise on technical findings. You will work within the offensive security team, delivering tests from scoping through reporting and post-test triage.

You will test web apps, APIs, and cloud services, explaining risks to technical and non-technical stakeholders. The role supports flexible/hybrid working with London visits quarterly.

Qualifications

• Hands-on penetration testing across complex systems, including web apps and APIs.
• Knowledge of testing tools, techniques, vulnerabilities, and risk reduction.
• Experience testing cloud services, APIs, and modern app architectures; aware of OWASP/CIS/PCI-DSS.
• Industry qualifications such as CREST CRT, OSCP, CSTM or equivalent; scripting ability.
• Independent work style with strong stakeholder relationships in security.
• Experience in financial services or regulated industries with timely reporting.

Responsibilities

• Perform penetration tests on new and existing systems, communicating findings to stakeholders.
• Help shape and improve security testing processes and tooling.
• Maintain and advance technical certifications to support career goals.
• Produce clear, actionable penetration testing reports for technical and non-technical audiences.

Skills

Penetration testing

Stakeholder communication

Cloud testing

Scripting languages

Education

CREST CRT

OSCP

CSTM

Job description

Nationwide is seeking a Penetration Testing Engineer to conduct security assessments across our estate and advise on technical findings. You will work within the offensive security team, delivering tests from scoping through reporting and post-test triage.

You will test web apps, APIs, and cloud services, explaining risks to technical and non-technical stakeholders. The role supports flexible/hybrid working with London visits quarterly.