Penetration Tester

About this role

Security owns the safety of a platform holding identity documents, salary data and CVs across several jurisdictions.

Attack our own platform before anyone else does, and write it up so engineering can fix it rather than argue with it. Internal, authorised, and scoped in writing.

The threat model is specific: account takeover, document forgery, automated abuse at scale, and people impersonating employers to defraud job seekers. That last one is why Trust & Safety exists as a separate function and why we work closely with it.

Primary responsibilities

• Test the web platform, the mobile apps and the APIs against a real attacker model, with authorisation and scope agreed in writing
• Focus where the risk is: authentication, session handling, tenant isolation, file upload and the authorisation boundary between a recruiter and a candidate
• Test the internal network and cloud configuration as well as the product
• Write reports that prove the finding, rate it honestly, and tell the team how to fix it
• Retest after remediation and confirm the fix rather than the intention
• Support the responsible-disclosure programme and triage what comes in through it

Skills required

Day to day this role works with Reporting, Penetration Testing and Web Security.

• Four or more years of hands-on offensive security
• Reports that a developer can act on, not a scanner dump
• Three or more years in offensive security with authorised testing experience
• Web application and API testing to a professional standard
• Authentication, session and authorisation testing in depth