Senior Test Engineer (Security) - Companies House - HEO

Government Digital and Data; East Midlands, West Midlands Combined Authority, London; Remote; GBP 45,000 - 60,000; Full time

Job summary

Join a leading government agency as a Senior Test Engineer specializing in security, focusing on enhancing our digital services. This role allows you to leverage your technical skills in security assessments, contribute to continuous improvement, and work in a collaborative environment aimed at delivering high-quality services. Candidates will benefit from a flexible remote work policy and a comprehensive benefits package, including a competitive pension scheme and substantial leave allocation.

Benefits

30 days annual leave

8 bank holidays

Civil Service Pension scheme

Flexible working hours

Qualifications

• Experience in security testing, preferably with relevant certifications.
• Knowledge of multiple security tools as listed, contributing to security assessment tasks.
• Ability to work collaboratively in a non-functional testing team.

Responsibilities

• Contribute to executing and coordinating security tests across the lifecycle.
• Run vulnerability scans and address security-related issues.
• Provide guidance and support to the wider testing team regarding security practices.

Skills

Security testing

Vulnerability assessments

Penetration testing

Collaboration

Education

Ethical hacking certification

Penetration testing certification

Tools

Burp Suite

OWASP ZAP

Postman

Jenkins

AWS

SQL

Git

Job description

Location

Remote working (anywhere in the UK)

About the job

Job summary

This is an exciting opportunity in the Digital Services team! You’ll be joining our team at a time of transformation, and you will be part of shaping the future of our department. We use Agile Methodologies and promote a culture of continuous improvement.

We are looking for an enthusiastic Senior Test Engineer (Non-Functional Security) with great technical skills, able to deliver and support security testing workstreams, including vulnerability assessments and penetration testing. You will also offer guidance to other testers on security testing best practices.

You will be part of our non-functional testing specialist team, working collaboratively with your team and overseeing the testing journey.

This provides an opportunity to make the test community thrive by exploring new and emerging tools and approaches and working out how you can help the organisation deliver better services.

This is a rewarding role within the Test Team and provides an opportunity to contribute to the success of existing and future services provided by Companies House.

Watch this video to find out more about working in Digital at Companies House

Companies House offers a flexible and welcoming culture that promotes a healthy work-life balance as well as a proactive approach to wellbeing that allows us to be our best at work. We recognise that people are the key to our success, so we offer a fantastic benefits package including flexible working with no core hours, 30 days annual leave, 8 bank holidays, and 1 privilege day, as well as enrolment into the Civil Service Pension scheme with a contribution rate averaging 28%.

Find out more about what a great place Companies House is to work

We're able to consider both full-time and part-time working patterns for this opportunity. For part-time, this must be a minimum of 30 hours per week, over 4 or 5 days.

Please note - Companies House cannot offer Visa sponsorship to candidates through this campaign. Additionally, a Security Check (SC) is an essential requirement for this role (at least 3 out of the last 5 years in the UK). Please see 'Things you need to know' section below for more information.

Job description

As a Senior Test Engineer focusing on security, you will:

Working within a delivery team, you’ll contribute to the coordination and execution of security testing across the software development lifecycle. This will involve running vulnerability scans using tools such as Burp, coordinating with relevant teams, testing security-related issues.
Support the wider test team by sharing knowledge and guidance on security testing approaches and tooling.
Attend meetings and provide stakeholders with updates.
Design and implement pipeline solutions to support automated security testing and reporting.

For more information on the Test Engineering profession and skills expected of a Lead, head over to the Government Digital and Data Profession Capability Framework.

Person specification

We are looking for the following, which will be assessed at sift, technical stage, and interview:

Experience in Security testing.
A relevant certification in ethical hacking or penetration testing, such as 7Safe CSTA or GIAC Penetration Testing, OR currently working towards this OR have proven working experience.
Working knowledge of at least 5 of the following security tools and technologies:

Burp Suite (including Burp Scanner)– for web app vulnerability scanning and manual security testing.
OWASP ZAP– for DAST and automated security regression testing.
Postman or SOAP UI– for API testing with a security focus (e.g., injection, authorisation, token misuse).
OAuth2 / OpenID Connect– for testing secure authentication and access control scenarios.
Jenkins or Concourse– for integrating security testing into CI/CD pipelines.
Unix/Linux-based systems– for using command-line tools, analysing logs, and running manual tests.
AWS (or similar cloud provider)– with a focus on IAM, S3 access, and common misconfiguration risks.
SQL / MongoDB / Oracle– for testing injection flaws, access controls, and data sanitisation.
Karate DSL or Rest Assured– for automating security-focused API tests.
Git or other version control systems– for secure code handling and integration with security scanners.
Static Application Security Testing (SAST) tools– e.g., SonarQube, Checkmarx, Semgrep.
Dynamic Application Security Testing (DAST) tools– e.g., OWASP ZAP, Burp Suite Pro.
Infrastructure-as-Code (IaC) scanning tools– e.g., tfsec, Checkov.
Secrets detection tools– e.g., GitLeaks, truffleHog, detect-secrets.
Threat modelling approaches– e.g., STRIDE, or creating risk-based test charters.
Familiarity with the OWASP Top 10– and how to test for each risk category.

Behaviours

We'll assess you against these behaviours during the selection process:

Making Effective Decisions
Managing a Quality Service
Working Together
Seeing the Big Picture

Technical skills

We'll assess you against these technical skills during the selection process:

Penetration testing / ethical hacking