Senior Penetration Tester

ThreatSpike Ltd.; United Kingdom; Remote; GBP 70,000 - 110,000; Full time

Job summary

ThreatSpike Ltd. is seeking a Senior Penetration Tester to lead web, internal and external assessments, using OWASP and MITRE ATT&CK frameworks. The role emphasizes mentorship, client communication, and hands-on testing across platforms.

Remote-first role across the United Kingdom, United States, Singapore and United Arab Emirates, with optional hybrid work in London. A strong foundation in systems, networks and programming is required, plus the ability to guide junior testers and engage with

Qualifications

• Experience following industry frameworks like OWASP and MITRE ATT&CK.

Responsibilities

• Execute web, internal, and external assessments per OWASP and MITRE ATT&CK.

Skills

Penetration testing

Red Team / adversary emulation

Programming experience

Excellent communication

Tools

Nmap

Burp Suite

XSStrike

SqlMap

GoPhish

Nessus

Nikto

BloodHound

GetUserSPNs.py

Job description

Skip to content

Senior Penetration Tester

About the Company

ThreatSpike is the world’s first AI-managed platform to deliver fully managed IT and complete cybersecurity as a single, fixed price subscription. One platform replaces the fragmented model of MSPs, MSSPs and point-solution vendors with one platform, one accountable team and one predictable monthly price.

As the first company to operate as both the technology vendor and the service provider simultaneously, ThreatSpike ships fixes directly into the platform the moment problems are found. Every customer benefits immediately.

Every capability ThreatSpike delivers runs inside a single platform, under one team. Not split between an IT provider, a security vendor and a pen testing firm that have never spoken to each other. There are no gaps between the tools. There are no gaps between the teams. There is no ambiguity about who owns the outcome.

About the Job

Threatspike Labs as a whole provides many types of penetration testing and red team adversary engagements that clients may choose from. This includes but is not limited to web and API testing, external and internal infrastructure testing, wireless and physical testing, as we as mature red team and assumed breach testing.

A penetration tester at Threatspike Labs will be expected to continue taking their professional development seriously.

Roles and Responsibilities

You would not be expected to perform solo assumed breaches or Red Team engagements. In this role, your primary duties will involve executing web application, internal, and external assessments following established industry frameworks like OWASP and MITRE ATT&CK. You may also provide mentorship by pairing with junior or mid-level penetration testers to guide them through their assessments. Based on your specific areas of specialization, you could be asked to participate in client meetings to address inquiries regarding various testing types. Additionally, you will occasionally be involved in supporting specific phases of larger Red Team engagements.

A perfect candidate would have:

• Motivation, passion and determination. This is what you can not learn from a course.
  • Questions you should be asking yourself are: How do I stay up to date with emerging adversary tradecraft, tooling and TTPs relevant to red team operations?
  • How do I growmy personal knowledge base and grow my capabilities, can I start looking at implementing what I know in more OPSEC ways?
  • Do I have personal goals that I have set for myself to better progress in my craft?
• Excellent problem-solving skills: You already have a mature research methodology set\p to handle unknown problems that arise during testing. If clients request an irregular approach to testing, you can propose a possible solution.
• Fully understand low level concepts including operating systems, networking, networking protocols, and the OSI model. You can make use of advanced TTPs on these different levels; understand where it may be necessary to develop custom solutions to overcome testing obstacles; and to understand your testing environments, and how systems react to the execution of pentesting tools.
• Experience with programming where you can understand code and identify vulnerabilities, as well as being capable of writing code to create scripts or tooling to aid in achieving testing goals.
• Hands‑on experience using different operating systems and networking technologies. At this level of job role, it should be expected that you have practiced experience with labs and training as well as real life experience testing industry environments and industry level technologies from professional testing setups.
• Excellent communication skills. As a senior penetration tester, you will be responsible for presenting your findings in debriefs, as well as communicating with clients throughout your engagements. You should be able to come across professionally and avoid miscommunication that could lead to delays or cause confusion. Additionally, you should be able to advise junior testers effectively and in an appropriate manner so that they can benefit from your experience and grow as testers.
• When looking at certification, you should be looking at more advanced certifications that focus on more advanced topics or niche areas of testing.
• In this role you will be expected to use various industry standard and in‑house tools, including
  (but not limited to) the following or equivalents:
  • External Mapping: Nmap, eyewitness, dirbuster, dig, etc
  • Web Exploitation: Burpsuite, XSStrike, SqlMap, etc
  • Phishing: EvilGinx, GoPhish
  • Vulnerability Scanning: Nessus, Nikto
  • ThreatSpike Wire – You would receive training on how to use our in house platform.
  • Internal testing: Bloodhound and collectors, Rubeus, Snaffler, Responder, GetUserSPNs.py.

In addition to using the above tooling you should be looking at OPSEC safe alternatives or
OPSEC safe methodology to achieve the same goals as some of these tools.

Learning and Development

Any candidate must have the ability and desire to understand and learn new concepts on their own in addition to the training we will provide. We are committed to helping the selected candidate obtain professional certifications. The goal is not for the candidate to remain a senior tester if accepted for the position, but then to advance internally by upskilling.

Location

This is a remote role and we are hiring in the following countries:

• United Kingdom
• United States
• Singapore
• United Arab Emirates

Should the candidate be London-based, there is an opportunity for optional hybrid working
from our Mayfair office to socialise and collaborate with other members of the team. However
this is not a requirement.