Manchester Digital
Senior Penetration Tester
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Senior Penetration Tester
Cybersecurity Penetration Tester – Digital Bank Role at Starling
Join the UK’s leading digital bank—built on technology that transforms how people save, spend, and manage money. Starling isn’t just a bank—it’s a fast-moving, collaborative tech disruptor with an open culture of innovation.
With over 3,000 employees spanning London, Southampton, Cardiff, and Manchester, we’re powered by technologists shaping the future of fintech. We believe in direct ownership, a hands-on approach, and empowering teams to thrive without rigid hierarchies.
About The Role
As a Penetration Tester, you’ll join a seasoned security team tasked with upholding Starling’s commitment to secure, user-friendly banking.
This internal tester role demands deep engagement across business functions. You’ll partner with engineers to: ✔ Conduct comprehensive scoping and penetration testing (mobile, web, cloud, infrastructure). ✔ Review, analyze, and propose security controls for technical solutions. ✔ Perform in-depth code reviews (prioritising Java and Go). ✔ Automate testing via bespoke tooling to ensure continuous assurance. ✔ Liaise with teams to mitiagte issues and align security improvements to our risk strategy.
Key Responsibilities
-
Penetration Testing
- Perform mobile (iOS/Android), web, cloud (AWS/GCP), and infrastructure penetrations.
- assure technical solutions meet security standards via reviews, assessments, and manual testing.
-
Collaborative Security
- Advise on and assist in responsible remediation of vulnerabilities.
- Identify opportunities to enhance team processes & methodologies to stay ahead of threats.
-
Knowledge Sharing & Mentorship
- Develop your expertise through targeted research and training.
- Guide junior peers, fostering a collaborative culture in cybersecurity leadership.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Ideal Requisites (Applicants Advised to Highlight)
✅ 5+ years frontline information security (penetration-focused, prior fintech a plus). ✅ Breadth of expertise in:
- Mobile semantics (iOS/Android: OWASP Guide, jailbreak testing, app instrumentation)
- Web application threats (OWASP Top 10, touching JWT, CSP, API security).
- Network security (ports, protocols: TCP/IP dissection,alien filter design).
- Cloud vetting (AWS Security, GCP, Vulnerability bounty analysis).
- Containerised threat models (Kubernetes, namespaces) alongside host security.
✅ Practical derive via testing:
- Justification/completments: validation of Static/Dynamic Security Analysis tools.
- Scripting/engineering: Python/Golang for automation.
✅ An explicit drive to apply your analytical brain in exploding security regions.
✅ Preferred qualifications/affiliations: 🔹 Crest Cert’ative Tester 🔹 OSCP 🔹 Experience with agile environments / infosec metrics (naissance prioritisation).
📨 Non-negotiables for UKRT:
- Authorization (CRBR/Cynthia set, UKGOA IVEL parsed).
- Methodological approach displaying the **significant legacy of hacking airifiers. ⚡ : Improve level ante collations
⚠️ *Note: Exceptions allowed influencingsee the process (#numbers vs degrees).
How We’ll Map Your Fit
Our interviews are non-traditional: collaborative, knowledgeable, and two-way. You'll get to engage directly with our tech culture. Here's the typical itinerary:
Stage 1
- Informal chat — project alignment, no catches.
Stage 2
- Technical pen-testing / forest-sorting
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Stage 3
- Final assessment with the Infosec Director and CISO to discuss long-term values and future.
Why Join Starling?
- Spatial and Collaborative Work: Must be commuter-office backed. Technology, minimum 1 onsite day/week.
- Holidays • 25 days + birthday perks + growth-based leave adjustments.
- Reinforces Impacts
- Paid leave extra: patient's community 16 hours, volunteer support.
- Planned 5-year retirement/join offer
- Grievances: Life cover @4x salary and group income security.
- Health: Private medical (Wavering Health) + cancer care + mental wellbeing company.
- Discounts: Mr. & Mrs. Smith client of Waitrose and fitness (hybrid Outlook including Peloton) with annual refresh benefits.
- *Wellness: enriched platform and scene financial rewards from Perkbox.
- *Cashier manifest: Infostack (wheel: Cycle to Work push gym/Crow Simplified pensions/AnalytixNet occupation unless CAR NOA cuts.)
Beyond AttrHamour
<— Join Us
Our culture is about equality and we don’t ensure compliance. Attributions are championed irrespective let-based traffic barriers.
Equity is our lead.
If your application doesn’t tick every ‘box’, open your candidacy anyway. We thrive during disruption, driven by diverse problem-soadters who modernize banking’s trajectory.
Statement
Starling Bank disconnect from our Personal Information Regulation: pursuant strictly processed by our Privacy Guidance. Please read our policy prior to any application**.
xdata xyz.netcon—mail ready.
Starling Bank is: LGBTQ+, me. Encased—our Theoretits ever bureaucratic flitty-choice.
Apply via [Job Board Link] ✅
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills