Senior Penetration Tester

Arcus Search; Greater London; Hybrid; GBP 70,000 - 120,000; Full time

Job summary

Arcus Search in the United Kingdom seeks a Senior Penetration Tester to lead offensive security efforts, break things safely, and drive fixes across apps, infra, and APIs.

You will work with engineers, the SOC, and product teams to turn findings into actionable remediation, build automated tools, and shape our security program as we scale.

Qualifications

• You’re experienced in penetration testing and offensive security.
• You can spot vulnerabilities in code (Java, Node.js).
• You understand modern architectures—AWS, microservices, APIs.
• You communicate remediation steps clearly and practically.
• You’re comfortable scripting and contributing to larger projects in Python.
• You take ownership and act without being told what to do.

Responsibilities

• Hack our own systems to find and fix vulnerabilities before others do.
• Run white-box and black-box pentests across apps, infrastructure, and APIs.
• Triage bug bounty reports and investigate external findings.
• Provide root cause analysis and variant investigation.
• Tear apart third-party tools to understand security risks.
• Build scrappy, scalable tools for recon, automation, and insights.
• Partner with engineers and the SOC to fix security gaps.
• Share knowledge through demos, workshops, and hands-on sessions.
• Help decide where to focus security efforts for maximum impact.
• Shape and evolve our security programme as we grow.

Skills

Penetration testing

Offensive security

Java

Node.js

Python

AWS

APIs

Microservices

Scripting

Communication

Ownership

Job description

Senior Penetration Tester

What You’ll Do

You’ll be on the front lines of our security efforts, thinking like an attacker to help us stay one step ahead. As a Senior Offensive Security Engineer, you’ll break things (responsibly), uncover weaknesses, and help us build stronger, more resilient systems.This is a hands‑on role where you’ll move fast, experiment, and have real impact. You’ll work closely with engineers, product teams, and security to turn findings into fixes — not just reports.

Day to day, you’ll:

• Hack our own systems to find and fix vulnerabilities before others do
• Run white-box and black-box pentests across apps, infrastructure, and APIs
• Triage bug bounty reports and dig into external findings
• Go beyond surface issues with root cause and variant analysis
• Tear apart third‑party tools and integrations to understand their risk
• Build scrappy (and scalable) tools for recon, automation, and insights
• Partner with engineers and the SOC to solve real security problems
• Share knowledge through demos, workshops, and hands‑on sessions
• Help us decide where to focus to get the biggest security wins
• Shape and evolve our security programme as we grow

Who You Are

You’re curious, pragmatic, and love breaking things to make them better. You don’t just find problems — you help fix them.

• Have solid experience in penetration testing and offensive security
• Can spot vulnerabilities in code (especially Java and Node.js)
• Understand modern architectures — AWS, microservices, APIs
• Communicate clearly and give practical, actionable remediation advice
• Comfortable scripting and contributing to larger projects in Python
• Take ownership and don’t wait to be told what to do

Nice to have:

• Certs like OSCP, OSWE, CREST, GIAC, AWS (or equivalent experience)
• CTFs, bug bounty hunting, or involvement in the security community