Addition
Principal Penetration Tester
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Principal Penetration Tester – 9 Month FTC
We’re working with a large, highly regulated organisation undergoing significant digital transformation. They’re looking for a Principal Penetration Tester to strengthen their internal security testing capability, combining deep application security expertise with hands-on offensive security and purple team work.
Role Overview:
- Location: Watford – Hybrid
- Package: Competitive salary + bonus & benefits
- Industry: Security / Technology
What You’ll Be Doing:
- Lead advanced penetration testing across web applications, APIs, backend services and connected platforms.
- Spend the majority of your time assessing application security across modern Java, Spring Boot and microservices environments.
- Test authentication, authorisation, session management, APIs, business logic and data flows to uncover vulnerabilities automated tooling may miss.
- Assess cloud-hosted and containerised applications, with a particular focus on AWS environments and application-level risk.
- Review SAST and DAST findings, cutting through false positives and helping engineering teams prioritise genuine security risks.
- Turn architecture and threat models into meaningful security testing strategies and practical test coverage.
- Support project and release assurance with clear recommendations around remediation, residual risk and security readiness.
- Help build and mature internal application security testing standards, playbooks and methodologies.
- Develop purple team exercises and adversary-informed testing alongside cyber defence teams.
- Explore realistic attack paths across Linux and Windows environments, including privilege escalation, exploit chaining and post-exploitation techniques.
- Apply MITRE ATT&CK principles to offensive testing scenarios and purple team exercises.
- Work with external security partners, turning assessment findings into measurable improvements to defensive capability.
- Act as a senior technical voice within the security function, coaching colleagues and improving the consistency and quality of testing.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Main Skills Needed:
- Strong hands-on penetration testing experience across web applications, APIs and service-based architectures.
- Deep understanding of Java backend environments, particularly Spring Boot, REST APIs and microservices.
- Experience assessing API gateways and Backend for Frontend architectures, including authentication, authorisation and data validation.
- Practical knowledge of AWS-hosted applications, containers and associated cloud security controls.
- Strong Linux and Windows security knowledge, including privilege escalation, credential risks and realistic exploitation techniques.
- Ability to perform manual security testing beyond automated scanning, particularly around business logic, attack chains and cross-layer vulnerabilities.
- Working knowledge of binary exploitation or lower-level vulnerability analysis.
- Strong understanding of modern web and mobile architectures, trust boundaries, sessions and data exposure risks.
- Experience developing security testing methodologies, standards or approaches rather than solely delivering individual assessments.
- Confident communicating technical vulnerabilities, business impact and remediation priorities to technical and non-technical stakeholders.
- Exposure to secure code review, mobile testing, adversary emulation or purple teaming would be beneficial.
- Knowledge of EDR/AV evasion concepts, exploit development, WAF technologies or vulnerability research would be valuable.
- CREST, OSCP, OSWE, OSEP or comparable hands-on experience would be advantageous.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
What’s in It for You:
- Hybrid working with a Watford base.
- Company bonus scheme.
- Matched pension contributions of up to 8.5%.
- 26 days’ annual leave, two additional life days and bank holidays.
- Private healthcare and income protection.
- £500 annual wellness allowance.
- Enhanced maternity, paternity and adoption leave.
- Flexible benefits covering areas including EV schemes, dental and eye care, financial coaching and mortgage advice.
- Volunteering opportunities and matched funding.
- The chance to shape an internal offensive security capability rather than simply execute an established testing programme.
- A senior technical role within a large-scale transformation environment where security has genuine visibility and impact.
We’re not box-tickers — if you’re close, reach out.
We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.
By applying you are confirming you are happy to be added to the Addition Solutions mailing list regarding future suitable positions. You can opt out of this at any time simply by contacting one of our consultants.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location