Penetration Tester

Contract Type:
Permanent

Location:
Alderley Park (Wilmslow) or Glasgow

Working Style:
Hybrid - 50% from home / 50% office based

The Penetration Tester role, working within the Attack Surface Management function, plays a key role in helping Royal London identify, assess and address security vulnerabilities across computer systems, networks and applications. The role supports the delivery of penetration testing across the Group, helping to simulate real-world cyber attacks and strengthen Royal London’s defences against current and emerging threats.

You will work closely with the wider Cyber Testing team to scope, deliver and report on penetration tests, applying ethical hacking principles and responsible testing practices. You’ll use your knowledge of network protocols, infrastructure, operating systems, security tooling and common application vulnerabilities to provide clear, practical insight that helps technical and non-technical stakeholders understand and remediate risk.

Contract Type:
Permanent

Location:
Alderley Park (Wilmslow) or Glasgow

Working Style:
Hybrid - 50% from home / 50% office based

The Penetration Tester role, working within the Attack Surface Management function, plays a key role in helping Royal London identify, assess and address security vulnerabilities across computer systems, networks and applications. The role supports the delivery of penetration testing across the Group, helping to simulate real-world cyber attacks and strengthen Royal London’s defences against current and emerging threats.

You will work closely with the wider Cyber Testing team to scope, deliver and report on penetration tests, applying ethical hacking principles and responsible testing practices. You’ll use your knowledge of network protocols, infrastructure, operating systems, security tooling and common application vulnerabilities to provide clear, practical insight that helps technical and non-technical stakeholders understand and remediate risk.

• Scope, deliver and report on penetration tests across Royal London’s systems, networks and applications.
• Simulate cyber attacks in a controlled and responsible way to identify vulnerabilities and help strengthen Royal London’s Attack Surface.
• Work closely with the Penetration Testing Technical Lead to define testing scope, objectives and rules of engagement.
• Apply penetration testing methodologies across the full lifecycle, from pre-test definition through to reporting, remediation support and closure.
• Use tools and techniques for scanning, reconnaissance, exploitation and analysis, including awareness of tools such as Burp, Metasploit, Wireshark and Nmap.
• Assess vulnerabilities across Linux, Windows, networks, infrastructure and web applications, including common issues such as SQL injection and cross-site scripting.
• Document findings clearly and communicate security risks, impacts and remediation guidance to both technical and non-technical stakeholders.
• Maintain auditable records to support penetration test results, management information and remediation requirements.
• Contribute to the development of penetration testing practices, methods and quality measures across the Attack Surface Management function.
• Bring an external view of penetration testing threats, techniques and good practice to team discussions and management information.
• Support the wider Operational Resilience function through consultation, advice, challenge and independent review of activities and proposals.
• Help scope, arrange and deliver external penetration tests with our 3rd party provider, assessing and validating and findings and reporting these to business owners with SME guidance and advice.

• A credible penetration testing professional with strong knowledge and operational experience of penetration testing methodology.
• Experience assessing large, complex networks and infrastructure environments, ideally within an enterprise-scale organisation.
• Strong understanding of network protocols, architecture and security mechanisms.
• Practical experience across operating systems including Linux and Windows, with the ability to identify and…