Penetration Tester

About This Role

This permanent role is critical in identifying, assessing, and mitigating security vulnerabilities within Bupa's applications, networks, and IT systems. The Penetration Tester conducts simulated attacks to evaluate the effectiveness of security measures, ensuring systems are resilient against real-world threats and validating the exploitability of identified vulnerabilities.

Responsibilities

• Perform thorough penetration testing on Bupa
• Use manual and automated tools to identify and exploit vulnerabilities in both internal and external systems
• Conduct assessments on web applications, mobile applications, network infrastructures, cloud environments, and endpoints
• Simulate real-world cyberattacks to evaluate the security posture of Bupa
• Safely exploit vulnerabilities to demonstrate the potential impact and exploitability of identified security weaknesses
• Provide a risk analysis of identified vulnerabilities based on severity, exploitability, and potential business impact
• Prioritise findings based on risk and collaborate with technical teams to address the most critical issues first
• Document and report all findings, including vulnerabilities, exploits, and recommendations for remediation
• Work closely with development, security, and IT teams to ensure vulnerabilities are remediated effectively and in a timely manner
• Provide guidance and support for the implementation of security best practices within development processes and system configurations
• Ensure all testing activities comply with organizational security policies, legal requirements, and industry standards (e.g., CREST, OWASP, NIST, GDPR)

Requirements

• 10+ years of experience in Information Technology, minimum 10 years
• Business and commercial acumen - strong business experience with a strong focus of the customer
• Vendor and partner management experience, including professional services and technology vendors
• Certifications required as below:
• Certified Ethical Hacker (CEH): Industry-standard certification focused on ethical hacking and penetration testing techniques
• Offensive Security Certified Professional (OSCP): Highly regarded certification for penetration testers, demonstrating practical skills in offensive security
• GIAC Penetration Tester (GPEN): A certification focused on penetration testing and ethical hacking methodologies
• Certified Cloud Security Professional (CCSP): Relevant if working with cloud environments (AWS, Azure, GCP)

Benefits

• Wellbeing program Viva, including access to health & general insurance discounts, information and education sessions, and preventative healthcare screening such as annual health assessments and skin checks