Security Testing Consultant (Penetration Tester) Hybrid

BAE Systems; Frimley; Hybrid; GBP 75,000 - 95,000; Full time

Job summary

BAE Systems Digital Intelligence is seeking a Security Testing Consultant – Penetration Tester to deliver security testing engagements across web applications, infrastructure, cloud environments and external attack surfaces. You will identify vulnerabilities and provide remediation guidance while producing clear reports for technical and non-technical audiences.

Role requires experience in penetration testing, familiarity with OWASP Top 10, and tools like Burp Suite, Nmap and Nessus.

Qualifications

• Experience in penetration testing, vulnerability assessment, or related security role.
• Knowledge of security testing methodologies, tools, and techniques: web, infrastructure, cloud, API, or mobile security.
• Ability to communicate technical findings clearly in reports and discussions.
• Familiarity with industry tools such as Burp Suite, Nmap, Nessus, Metasploit, BloodHound.
• Willingness to travel within the UK and internationally; aim for CHECK Team Member status within 6 months.

Responsibilities

• Support security testing engagements across web, infrastructure, cloud, and external surfaces.
• Perform and deliver security assessments independently and with supervision.
• Identify and document vulnerabilities; provide remediation guidance and clear reports.
• Utilise testing tools in line with company standards and client requirements.
• Collaborate with Security Testing, Threat Intelligence, Incident Response, and Security Consulting teams to deliver client outcomes.
• Contribute to internal tooling, automation, and testing methodologies.
• Stay aware of emerging threats and security technologies.
• Participate in training and certification to progress toward CHECK Team Member status.

Skills

Penetration testing

Vulnerability assessment

Security testing methodologies

OWASP Top 10

Burp Suite

Nessus

Metasploit

Tools

Burp Suite

Nmap

Nessus

Metasploit

BloodHound

Job description

Location(s): UK, Europe & Africa : UK : Frimley || UK, Europe & Africa : UK : Gloucester || UK, Europe & Africa : UK : Guildford || UK, Europe & Africa : UK : Leeds || UK, Europe & Africa : UK : London || UK, Europe & Africa : UK : Manchester BAE Systems Digital Intelligence is home to 4,500 digital, cyber and intelligence experts. We work collaboratively across 10 countries to collect, connect and understand complex data, so that governments, nation states, armed forces and commercial businesses can unlock digital advantage in the most demanding environments.

Job Title: Security Testing Consultant – Penetration Tester

Location: UK Wide (Occasional office work, with 25% International Travel)

Who We Are

Join BAE Systems and you’ll be part of something bigger. As a valued member of our global colleague network, you’ll bring your unique skills and perspectives to help pioneer progress and protect what matters most. You’ll be trusted to play your part in delivering the advanced, technology-led defence, aerospace and security solutions of tomorrow – shaping a safer future, for all of us.

From the depths of the ocean, to the far reaches of space – there’s no limit to where a career at BAE Systems could take you!

About The Role…

We are looking for people who have experience of Security / Penetration Testing who are ready to have a meaningful and tangible impact as part our cyber threat intelligence team investigating and tracking cyber-attacks against organisations around the world. Our CTS team works together to build rich profiles of high-priority threat actor campaigns providing our threat intelligence customers with both technical data feeds and contextualised reports via a secure portal. This is an excellent opportunity develop your career and help shape a safer future for all of us!

What You Could Be Doing…

• Supporting the delivery of security testing engagements across all areas of security testing, from web applications, infrastructure assessments, cloud environments and external attack surfaces.
• Perform and deliver security assessments independently and complex assessments under the supervision of senior consultants, following established methodologies and customer requirements.
• Identify, validate, and document security vulnerabilities, providing accurate and practical remediation advice whilst producing clear and professional reports for both technical and non-technical audiences.
• Safely utilise security testing tools and techniques in accordance with company standards and customer requirements.
• Collaborate with colleagues across Security Testing, Threat Intelligence, Incident Response, and Security Consulting to deliver high-quality client outcomes.
• Contribute to the development of internal tooling, automation, testing methodologies, and research initiatives.
• Maintain awareness of emerging threats, vulnerabilities, attack techniques, and security technologies.
• Participate in technical training, mentoring, and certification programmes to support progression towards CHECK Team Member status.

The Skills And Experience You Will Need….

Experience in penetration testing, vulnerability assessment, systems administration, software development, or a closely related technical security role.

Demonstrable understanding of common security testing methodologies, tools, and techniques across one or more of the following:

• Web Application Security
• Infrastructure Security
• Cloud Security
• API Security
• Mobile Security

Strong understanding of common vulnerabilities and exploitation techniques, including the OWASP Top 10 and network security fundamentals whilst possessing the ability to communicate technical findings clearly in both written reports and verbal discussions.

Practical experience with industry-standard security tools such as Burp Suite, Nmap, Nessus, Metasploit, BloodHound, or similar.

Self-motivated with a desire to continuously develop technical and consulting skills and eligible and willing to obtain CHECK Team Member status within the first 6 months of employment.

Flexibility and willingness to travel within the UK and Internationally when required.

Desirable Requirements

Offensive security certifications such as:

• Offensive Security Certified Professional
• Practical Network Penetration Tester
• CREST CPSA
• CREST Registered Tester
• Cyberscheme Team Member
• eLearnSecurity Certified Professional Penetration Tester
• CompTIA PenTest+
• Working Towards the Practitioner Level of the UK Professional Charter

Experience participating in Capture The Flag (CTF) competitions, bug bounty programmes, or personal security research projects.

Current Security Clearance (SC) or ability to obtain clearance.

Life at BAE Systems Digital Intelligence

We are embracing Hybrid Working. This means you and your colleagues may be working in different locations, such as from home, another BAE Systems office or client site, some or all of the time, and work might be going on at different times of the day.

By embracing technology, we can interact, collaborate and create together, even when we’re working remotely from one another. Hybrid Working allows for increased flexibility in when and where we work, helping us to balance our work and personal life more effectively, and enhance well-being.

Diversity and inclusion are integral to the success of BAE Systems Digital Intelligence. We are proud to have an organisational culture where employees with varying perspectives, skills, life experiences and backgrounds – the best and brightest minds – can work together to achieve excellence and realise individual and organisational potential.

Division overview: Government

At BAE Systems Digital Intelligence, we pride ourselves in being a leader in the cyber defence industry, and Government contracts are an area we have many decades of experience in. Government and key infrastructure networks are critical targets to defend as the effects of these networks being breached can be devastating.

As a member of the Government business unit, you will defend the connected world and ensure the protection of nations. We all have a role to play in defending our clients, and this is yours.