Penetration Tester (Web Application & API)
A hands-on penetration testing role delivering web application, API and systems assessments for a global law firm, based in Belfast with 2 days a week on site, paying £40,000 to £50,000.
About the Company
Our client is a global law firm making a major investment in cyber security and AI. They are creating three new Penetration Tester roles to increase testing capacity, clear existing backlogs and help secure the firm's applications, platforms, systems and new AI-enabled solutions.
The Role
You will join the in-house penetration testing team and deliver assessments independently, with much of your time spent on manual testing of live web applications and APIs. This is a hands-on technical role where your testing ability matters far more than polish. As the firm's AI adoption grows, you will also help assess the security of AI-enabled applications and agents. Offensive, hands-on experience from any sector is welcome, whether that is consultancy, financial services, tech, government, defence or elsewhere.
Key Responsibilities
- Deliver hands-on penetration tests across the firm's applications, platforms and systems, working independently.
- Carry out manual web application testing against live applications using OWASP-based methodologies.
- Test APIs, including REST and GraphQL services and their authentication and authorisation controls.
- Identify, validate and exploit vulnerabilities, accurately confirming which findings are real.
- Write clear reports with practical, actionable recommendations for technical and non-technical audiences.
- Contribute to application architecture reviews.
- Help assess the security of AI-enabled applications and agents as the firm's use of AI grows.
- Work with the team to clear the existing testing backlog and increase testing capacity.
What You'll Need
- Hands-on penetration testing, including significant manual web application testing, is essential, and the single most important thing we are looking for.
- Strong hands-on use of Burp Suite and Kali Linux is essential.
- Solid knowledge of the OWASP Top 10, CVEs and exploitation techniques is essential.
- A clear understanding of how a vulnerability assessment differs from a penetration test is essential.
- The ability to write clear reports and explain technical findings to non-technical colleagues is essential.
- API testing experience across REST, GraphQL, authentication and authorisation is highly advantageous.
- Experience of application architecture reviews is highly advantageous.
- Experience testing AI-enabled applications or agents, or using AI to support your testing, is a strong advantage.
- OSCP is a strong advantage, though practical testing experience counts for more than certifications alone.
- Experience with Nessus, AppScan, Nipper, Metasploit or Wireshark is desirable.
- CISSP, GPEN, GWAPT, GAIPT, CEH or other GIAC certifications are desirable.
Why Apply?
- Join one of three new roles created as part of a major investment in cyber security and AI.
- Focus on hands-on technical testing, where your ability is valued above polish.
- Work on the security of AI-enabled applications and agents, an area few testing roles offer.
- Hybrid working in Belfast, 2 days a week on site, with all formal interview stages available virtually.
- A salary of £40,000 to £50,000, plus private medical insurance, pension matching up to 8% and life assurance at 4x salary.
- 25 days' annual leave plus bank holidays, rising to 28 days.
- A clear two-stage process, including time with the Chief Security Officer.
Note For Applicants
All candidates must be currently residing in NI and have full UK Right to Work. Visa Sponsorship for this role is not provided.
Interested?
For a confidential conversation about the role, contact Jordan Madden at