17 of 17 Permanent OWASP Jobs in London

conducting threat modelling (e.g. STRIDE, attack trees) and risk analysis Strong understanding of security frameworks and best practice such as ISO 27001, NIST, CIS, OWASP, NCSC guidance Experience working in the UK Public Sector and associated security standards and guidance including GovAssure/NCSC CAF, HMG Security Policy Framework. Knowledge ...

tools in cloud environments is a plus Cloud Security skills (desired): Secure software development practices, including SecDevOps Sound knowledge of applicable frameworks & standards, including OWASP, MITRE ATT@CK & D3FEND, CIS, NIST CSF, CSA CCM & ISO 27107 Relevant industry certifications including CSCP Understanding of cyber risk frameworks or industry standards such ...

practical knowledge of offensive security across web applications, APIs, networks, and cloud environments Solid understanding of system internals, networking, and common vulnerability classes including OWASP Top 10, authentication and authorisation flaws, logic issues, and race conditions Familiarity with Windows and Linux environments from an attacker's perspective Proficiency with standard ...

wireless, and mobile security testing. Experience leading security teams and managing the delivery of offensive security engagements. Deep understanding of penetration testing methodologies including OWASP Testing Guide, PTES, and OSSTMM. Experience working within Red Team, Blue Team, and Purple Team environments. Strong knowledge of common attack techniques, threat emulation, vulnerability ...

Lifecycle Professional) GWAPT (GIAC Web Application Penetration Tester) GCSA (GIAC Cloud Security Automation) CASE (Certified Application Security Engineer) Certified DevSecOps Professional Strong familiarity with OWASP (including Top 10 and ASVS) At least 5 years experience in information security assurance, with a strong focus on application security. Hands-on experience with ...

Lifecycle Professional) GWAPT (GIAC Web Application Penetration Tester) GCSA (GIAC Cloud Security Automation) CASE (Certified Application Security Engineer) Certified DevSecOps Professional Strong familiarity with OWASP (including Top 10 and ASVS) At least 5 years’ experience in information security assurance, with a strong focus on application security. Hands-on experience with ...

Microsoft Purview • Background in eComm, marketplace, or retail technology • Scripting (Python, PowerShell), Terraform, or detection-as-code experience • Familiarity with NIST CSF, ISO 27001, OWASP LLM Top 10, or similar frameworks What's on Offer for the Security Engineer • Real ownership — a genuine mandate to drive change, with the tooling ...

business terms to exec and board audiences, and technical terms to engineers, without losing precision in either direction. Technical foundation Strong AppSec expertise (OWASP, API security, SAST/DAST, SDLC) with practical threat modelling experience – enough to challenge and coach our most senior application security engineers. Hands‐on understanding ...

influencing technical direction. Experience using AI to accelerate software delivery. Bonus Points For Cyber security or regulated industry experience. Kubernetes and cloud-native technologies. OWASP, ISO 27001 or IEC 62443. Open-source contributions. ...

Awareness of AI/ML in security operations and AI-specific threats (e.g. prompt injection, sensitive-data exposure via GenAI), with awareness of the OWASP LLM Top 10 and MITRE ATLAS. Exposure to cloud detection across Azure, AWS, and/or GCP and to cloud and identity log sources (e.g. ...

protection posture Familiarity with cloud networking constructs (VNets/VPCs, routing, load balancers, private endpoints, segmentation) Knowledge of common web application attack techniques (e.g. OWASP Top 10: injection, XSS, API abuse) and mitigation approaches Experience working with infrastructure-as-code and automation tools (Terraform, ARM, CloudFormation) for WAF deployment ...

upheld, delivering best-in-class solutions. Ensure governance and decision-making processes are effective. Have extensive experience in standards such as PCI-DSS, OWASP, ISO 27001, ISO 9001, and others, championing adherence and implementation. People Help teams adopt good practices and techniques to deliver quality software at pace. Advocate ...

Experience with infrastructure and DevOps fundamentals: CI/CD, cloud platforms, CDN, monitoring/observability, and deployment strategies. Strong understanding of security best practices (OWASP, authentication/authorization patterns, secure data handling) — especially in a financial context. Experience hiring, mentoring, and growing engineers — building a high‐performing team, not just ...

enable consistent and compliant environm entsImplement automation across build, test, and deployment processes to ensure reliable and repeatable deli veryApply security best practices, including OWASP principles, throughout the development and deployment lifec ycleDeploy and manage containerised applications using Kubernetes or AWS-native services such as ECS or EKSMonitor system performance … using Terraform for infrastructure-as-code del iverySolid understanding of Kubernetes architecture and cloud-based container orchestr ationWorking knowledge of secure development practices, including OWASP principles within CI/CD and infrastructure d esignExperience with scripting languages such as Python, Bash, or Power ShellFamiliarity with Agile delivery environments and collaboration ...

prompt injection, goal hijacking, memory poisoning, non-human identity abuse, and multi-agent attack surfaces. Understanding of EU AI Act, NCSC AI security guidelines, OWASP GenAI Security Project, and MITRE ATLAS. Ideally involved in academic and/or industry research on AI Security Leadership behaviours: Strategic thinking: able to translate ...

reporting. Coordinate remediation follow-up and retesting activities. Maintain accurate documentation, testing records, and asset inventories. Follow recognised security frameworks and testing methodologies, including OWASP and CREST-aligned practices. What They Are Looking For: Essential: Approximately 1-2 years of Cyber Security experience. Exposure to Vulnerability Assessment, Security Testing, Vulnerability … such as Nmap, Burp Suite, Kali Linux, Metasploit, Nikto, or Gobuster. Understanding of CVEs, CVSS scoring, vulnerability prioritisation, and remediation processes. Awareness of the OWASP Top 10 and common web application vulnerabilities. Strong written communication and report-writing skills. Desirable: CREST CPSA, CompTIA Security+, CompTIA PenTest+, eJPT, PNPT, or similar ...

clients, and formal reports Assist senior penetration testers with research, evidence collection, and report writing Adhere to internal methodologies and industry frameworks, including NIST, OWASP, and CREST best practices What They're Looking For: 1-2 years' experience in vulnerability assessment, security testing, or junior penetration testing Good understanding … Familiarity with penetration testing tools including Kali Linux, Nmap, Burp Suite, Metasploit, Nikto, and Gobuster Understanding of CVEs, CVSS scoring, vulnerability prioritisation, and the OWASP Top 10 Ability to perform reconnaissance, enumeration, service analysis, and controlled validation of findings Strong written communication skills with the ability to produce clear technical ...