About this role
Moore Kingston Smith is seeking an experienced penetration tester to join our NCSC-recognised cyber security team within our Risk Advisory practice, supporting a diverse portfolio of clients across multiple sectors. This is a hands-on role focused on delivering penetration tests across web applications, APIs, and internal and external network infrastructure. You will also support Cyber Essentials Plus assessments and wider technical security reviews, including vulnerability assessments, configuration reviews against recognised benchmarks, and cloud security reviews.
You will identify and safely validate security weaknesses, explain the associated business risks clearly, and provide practical remediation advice tailored to each client. We are looking for an individual with strong technical fundamentals, sound professional judgement and a genuine interest in helping clients improve their security posture. Alongside developing your offensive security expertise, you will have the opportunity to contribute to the growth of the cyber security practice and increasingly take ownership across technical delivery, knowledge-sharing and the development of our services.
While technical delivery will remain the core focus, if interested, you will also have the opportunity to contribute to broader cyber security engagements, including cyber maturity assessments, security control reviews, audit readiness activities and security design advisory work.
- Lead and support penetration testing engagements across web applications, APIs, and internal and external network infrastructure.
- Work with clients to define objectives, agree scope and rules of engagement, and plan testing that meets their assurance needs.
- Apply manual and tool-assisted testing techniques aligned with recognised methodologies and frameworks, including the OWASP Web Security Testing Guide, PTES, and MITRE ATT&CK.
- Deliver Cyber Essentials Plus assessments, including scoping, conducting the required technical tests, verifying remediation and supporting clients through to certification in line with current NCSC and IASME scheme requirements.
- Deliver wider technical security assessments, including vulnerability assessments, cloud security reviews, and build and configuration reviews against CIS Benchmarks and vendor hardening guidance.
- Produce clear, high-quality deliverables and present findings to technical and non-technical stakeholders.
- Apply appropriate risk ratings, explain business impact, and support clients with remediation and retesting.
- Support general advisory engagements such as cyber risk assessments, security control reviews, audit readiness, remediation planning and security design advice.
- Build strong client relationships and contribute to business development, supporting proposals, scoping, tenders and thought leadership, and identifying opportunities to expand our services.
- Maintain current knowledge of the threat landscape, emerging attack techniques, testing methodologies, and scheme requirements, while contributing to peer review and quality assurance.
- Contribute to the continuous improvement of our methodologies, tooling, delivery processes, and technical capability.