Senior Penetration Tester

Ocho; Belfast City District; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Private medical insurance

Pension matching up to 8%

Life assurance 4x salary

25 days’ annual leave plus bank and公共假

Hybrid in Belfast

Job summary

Ocho is seeking a hands-on Penetration Tester in Belfast to deliver assessments of web apps, APIs, and systems for a global law firm. The role combines on-site and hybrid work with a strong emphasis on practical testing and reporting.

You will also assess AI-enabled applications as the firm grows its AI usage. Expect 2–3 days on-site in Belfast, with a salary from £70,000 to £110,000 and benefits including private medical, pension matching up to 8%, and life assurance at 4x salary, plus 25 days

Qualifications

• Hands-on penetration testing is essential.
• Experience testing web applications and APIs is required.
• Strong knowledge of OWASP Top 10 and exploitation techniques is essential.
• Ability to write clear reports and explain findings to non-technical audiences.

Responsibilities

• Deliver hands-on penetration tests across applications, platforms and systems, working independently.
• Carry out manual web application testing against live applications using OWASP-based methodologies.
• Test APIs (REST and GraphQL) and their authentication/authorization controls.
• Identify, validate and exploit vulnerabilities, confirming which findings are real.
• Write clear reports with actionable recommendations for technical and non-technical audiences.
• Contribute to application architecture reviews and help assess AI-enabled applications.
• Help clear testing backlog and increase testing capacity.

Skills

Manual testing

Burp Suite

Kali Linux

OWASP Top 10

API testing

Report writing

AI security testing

OSCP

Tools

Nessus

Metasploit

Wireshark

AppScan

Nipper

Job description

A hands-on penetration testing role delivering web application, API and systems assessments for a global law firm, based in Belfast with 2/3 days a week on site, paying £70,000 - £110,000.

About the Company

Our client is a global law firm making a major investment in cyber security and AI. They are creating three new Penetration Tester roles to increase testing capacity, clear existing backlogs and help secure the firm’s applications, platforms, systems and new AI-enabled solutions.

The Role

You will join the in-house penetration testing team and deliver assessments independently, with much of your time spent on manual testing of live web applications and APIs. This is a hands‑on technical role where your testing ability matters far more than polish. As the firm’s AI adoption grows, you will also help assess the security of AI-enabled applications and agents. Offensive, hands‑on experience from any sector is welcome, whether that is consultancy, financial services, tech, government, defence or elsewhere.

Key Responsibilities

• Deliver hands‑on penetration tests across the firm’s applications, platforms and systems, working independently.
• Carry out manual web application testing against live applications using OWASP‑based methodologies.
• Test APIs, including REST and GraphQL services and their authentication and authorisation controls.
• Identify, validate and exploit vulnerabilities, accurately confirming which findings are real.
• Write clear reports with practical, actionable recommendations for technical and non-technical audiences.
• Contribute to application architecture reviews.
• Help assess the security of AI-enabled applications and agents as the firm’s use of AI grows.
• Work with the team to clear the existing testing backlog and increase testing capacity.

What You’ll Need

• Hands‑on penetration testing, including significant manual web application testing, is essential, and the single most important thing we are looking for.
• Strong hands‑on use of Burp Suite and Kali Linux is essential.
• Solid knowledge of the OWASP Top 10, CVEs and exploitation techniques is essential.
• A clear understanding of how a vulnerability assessment differs from a penetration test is essential.
• The ability to write clear reports and explain technical findings to non-technical colleagues is essential.
• API testing experience across REST, GraphQL, authentication and authorisation is highly advantageous.
• Experience of application architecture reviews is highly advantageous.
• Experience testing AI-enabled applications or agents, or using AI to support your testing, is a strong advantage.
• OSCP is a strong advantage, though practical testing experience counts for more than certifications alone.
• Experience with Nessus, AppScan, Nipper, Metasploit or Wireshark is desirable.
• CISSP, GPEN, GWAPT, GAIPT, CEH or other GIAC certifications are desirable.

Why Apply?

• Join one of three new roles created as part of a major investment in cyber security and AI.
• Focus on hands‑on technical testing, where your ability is valued above polish.
• Work on the security of AI-enabled applications and agents, an area few testing roles offer.
• Hybrid working in Belfast, 2 days a week on site, with all formal interview stages available virtually.
• A salary of £70,000 to £110,000, plus private medical insurance, pension matching up to 8% and life assurance at 4x salary.
• 25 days’ annual leave plus bank holidays, rising to 28 days.
• A clear two‑stage process, including time with the Chief Security Officer.

Note For Applicants

All candidates must be currently residing in NI and have full UK Right to Work. Visa Sponsorship for this role is not provided.