Web Application & Infrastructure Penetration Tester

• Conduct comprehensive penetration testing activities across web applications, APIs, cloud-native services, mobile applications, and supporting infrastructure.
• Identify, exploit, validate, and document security vulnerabilities, particularly those aligned to the OWASP Top 10 framework.
• Perform Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) to identify insecure coding practices and runtime vulnerabilities.
• Assess API security, including authentication, authorisation, and data exposure risks.
• Conduct security testing of iOS and Android mobile applications and their supporting backend services.
• Produce high-quality technical reports that clearly communicate findings, risks, and practical remediation recommendations.
• Collaborate with development, infrastructure, and business teams to support remediation activities and improve security outcomes.
• Contribute to the enhancement of security testing methodologies, standards, and best practices across the organisation.
• Support the ongoing development of OUPs cyber resilience capabilities through proactive identification and management of security risks.

• Demonstrable experience conducting manual and automated penetration testing of modern web applications and supporting infrastructure.
• Strong knowledge of application security principles and vulnerability assessment techniques.
• Deep understanding of the OWASP Top 10 and experience identifying, exploiting, validating, and reporting vulnerabilities across all categories.

Experience testing applications developed using technologies such as:

• .NET / asp.net
• Java / Spring
• Node.js
• Python frameworks
• PHP frameworks
• React, Angular, Vue.js, and other JavaScript front-end technologies
• REST and GraphQL APIs
• Single Page Applications (SPAs)

• Experience performing API security assessments.
• Strong written and verbal communication skills, with the ability to present technical findings to both technical and non-technical audiences.

Experience using industry-standard security testing tools, including:

• Kali Linux
• Nmap
• Burp Suite Professional

Experience with additional security testing tools such as:

• Owasp ZAP
• JWT Toolkits
• ffuf
• Dirb, GoBuster, Feroxbuster
• Metasploit
• CrackMapExec / NetExec
• WPScan
• CMSMap
• SQLMap
• Nuclei
• Wafw00f / LBD

• Experience conducting mobile application security testing across iOS and Android platforms.
• Degree in Computer Science, Information Security, or a related discipline.
• Industry certifications such as OSCP, CEH, CISSP, or equivalent.

• Naturally inquisitive, with a desire to investigate beyond the obvious and gain deeper understanding of systems and risks.
• Analytical and methodical approach to solving complex problems.
• Ability to translate technical security concepts into practical business-focused recommendations.
• Strong stakeholder engagement and communication skills.
• Adaptable, proactive, and committed to continuous professional development.
• Self-motivated with a focus on delivering high-quality outcomes.