Web Application & Infrastructure Penetration Tester

At Oxford University Press, we are passionate about advancing learning, education, and research worldwide. As a Cyber Security & Resilience Testing Specialist, you will play a critical role in protecting our digital platforms, services, and data while supporting our mission to make a positive impact through education.

This is an exciting opportunity for an experienced penetration testing professional to join a collaborative and highly skilled Cyber Security team. You will work across a diverse technology landscape, testing modern web applications, APIs, cloud services, mobile applications, and supporting infrastructure. The role offers exposure to a variety of technologies and security challenges, allowing you to continuously develop your expertise while helping strengthen OUP's security posture.

If you are naturally curious, enjoy solving complex security challenges, and are passionate about offensive security and continuous learning, this role offers the opportunity to make a tangible impact across the organisation.

As a Cyber Security & Resilience Testing Specialist, you will:

Conduct comprehensive penetration testing activities across web applications, APIs, cloud-native services, mobile applications, and supporting infrastructure.

Identify, exploit, validate, and document security vulnerabilities, particularly those aligned to the OWASP Top 10 framework.

Perform Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) to identify insecure coding practices and runtime vulnerabilities.

Assess API security, including authentication, authorisation, and data exposure risks.

Conduct security testing of iOS and Android mobile applications and their supporting backend services.

Produce high-quality technical reports that clearly communicate findings, risks, and practical remediation recommendations.

Collaborate with development, infrastructure, and business teams to support remediation activities and improve security outcomes.

Contribute to the enhancement of security testing methodologies, standards, and best practices across the organisation.

Support the ongoing development of OUP's cyber resilience capabilities through proactive identification and management of security risks.

This role is essential in helping OUP identify and address security weaknesses before they can be exploited. Your expertise will directly contribute to protecting business-critical systems, sensitive information, digital products, and services used by learners, educators, researchers, and employees around the world. Through your work, you will help strengthen organisational resilience and support the delivery of secure and trusted digital experiences.

Demonstrable experience conducting manual and automated penetration testing of modern web applications and supporting infrastructure.

Strong knowledge of application security principles and vulnerability assessment techniques.

Deep understanding of the OWASP Top 10 and experience identifying, exploiting, validating, and reporting vulnerabilities across all categories.

Experience testing applications developed using technologies such as: .NET / ASP.NET Java / Spring Node.js Python frameworks PHP frameworks React, Angular, Vue.js, and other JavaScript front-end technologies REST and GraphQL APIs Single Page Applications (SPAs)

.NET / ASP.NET

Java / Spring

Node.js

Python frameworks

PHP frameworks

React, Angular, Vue.js, and other JavaScript front-end technologies

REST and GraphQL APIs

Single Page Applications (SPAs)

Experience performing API security assessments.

Strong written and verbal communication skills, with the ability to present technical findings to both technical and non-technical audiences.

Experience using industry-standard security testing tools, including: Kali Linux Nmap Burp Suite Professional

Kali Linux

Nmap

Burp Suite Professional

Experience with additional security testing tools such as: OWASP ZAP JWT Toolkits ffuf Dirb, GoBuster, Feroxbuster Metasploit CrackMapExec / NetExec WPScan CMSMap SQLMap Nuclei Wafw00f / LBD

OWASP ZAP

JWT Toolkits

ffuf

Dirb, GoBuster, Feroxbuster

Metasploit

CrackMapExec / NetExec

WPScan

CMSMap

SQLMap

Nuclei

Wafw00f / LBD

Experience conducting mobile application security testing across iOS and Android platforms.

Degree in Computer Science, Information Security, or a related discipline.

Industry certifications such as OSCP, CEH, CISSP, or equivalent.

Naturally inquisitive, with a desire to investigate beyond the obvious and gain deeper understanding of systems and risks.

Analytical and methodical approach to solving complex problems.

Ability to translate technical security concepts into practical business-focused recommendations.

Strong stakeholder engagement and communication skills.

Adaptable, proactive, and committed to continuous professional development.

Self-motivated with a focus on delivering high-quality outcomes.

Please contact [email protected] with any queries relating to this role. To ensure a smooth application process, please submit your CV through the application link rather than via email.

We are committed to supporting diversity in our workforce and ensuring an inclusive environment where all individuals can thrive. We seek to employ a workforce representative of the markets that we serve and encourage applications from all backgrounds.