Lead Penetration Tester

Salary: £36,000 - 76,000 per year

Requirements:

• Significant experience in penetration testing / offensive security, with the ability to lead complex testing engagements.
• Strong hands-on understanding of penetration testing across applications, infrastructure and technology environments.
• Proven experience managing the full penetration testing lifecycle, including scoping, planning, execution, reporting and remediation.
• Experience overseeing and managing third-party penetration testing suppliers.
• Strong ability to review, interpret and challenge penetration testing reports and technical findings.
• Proven experience managing vulnerabilities and security defects through to remediation.
• Experience working closely with engineering, DevOps, product and delivery teams.
• Strong stakeholder management skills, with the ability to translate technical vulnerabilities into clear business risks and required actions.
• Experience using Jira or similar tooling to manage security findings and remediation activity.
• Strong understanding of security risk assessment, vulnerability prioritisation and risk acceptance.
• Knowledge of recognised penetration testing methodologies and security frameworks.
• Relevant penetration testing/offensive security certifications such as CREST, OSCP, OSWE, GPEN or equivalent.
• Experience operating within large, complex or highly regulated organisations.
• Experience across cloud environments, particularly Azure and/or AWS.
• Experience with application, API, network, infrastructure and/or cloud penetration testing.
• Familiarity with vulnerability management and security operations processes.
• Experience working within environments subject to ISO 27001, PCI-DSS, GDPR or CAF requirements.

Responsibilities:

• Lead the end-to-end penetration testing lifecycle, including scoping, planning, execution, reporting and remediation across applications, infrastructure and systems.
• Provide hands-on penetration testing expertise while coordinating and overseeing third-party testing providers.
• Review and challenge penetration testing reports, assessing findings based on severity, exploitability, business impact and risk.
• Work closely with engineering, DevOps, product and delivery teams to prioritise and drive vulnerabilities through to resolution within agreed SLAs.
• Own the tracking and management of penetration testing findings in Jira, ensuring actions are assigned, monitored and closed.
• Lead regular remediation discussions with internal stakeholders and third parties, escalating blockers and ensuring residual risks are appropriately recorded and accepted.
• Ensure penetration testing and remediation activities align with relevant security standards, regulatory requirements and industry best practice, including OWASP, NIST, ISO 27001, PCI-DSS, GDPR and CAF.
• Ensure appropriate governance, documentation and evidence is maintained throughout the testing lifecycle.
• Provide assurance over the quality and effectiveness of third-party penetration testing engagements.
• Identify and implement improvements to penetration testing, vulnerability management and remediation processes.
• Use testing outcomes, lessons learned and emerging threats to improve security controls and testing methodologies.

Technologies:

• API
• AWS
• Azure
• Cloud
• DevOps
• JIRA
• Network
• OWASP
• Security

More:

This is a contract Lead Penetration Tester role for an initial 6 months at a day rate of £700–£800 per day, inside IR35. We require 1 day per month on site, either in Chesterfield or London. This is a hands-on leadership role where we combine penetration testing expertise with coordination of testing engagements, third-party suppliers, vulnerability remediation and security findings. You will work closely with internal engineering, DevOps, product and delivery teams, as well as external providers, to ensure testing is scoped and executed to a high standard and that vulnerabilities are prioritised through to resolution. This role is suited to a senior/lead-level penetration tester who wants ownership of the testing and remediation lifecycle.

last updated 35 week of 2026