Penetration Tester

In this role, you won't be confined to traditional 4+1 web applications. We've broken away from the constraints of CHECK or CE+ standards, and we're not interested in producing lengthy PDF reports. Instead, our focus is on seamlessly integrating continuous penetration testing into our customers' Software Development Life Cycle (SDLC).

What you'll do:

As a Penetration Tester at Cytix, you'll form a core part of our Application Security team, and play in pivotal role in our organisation. In this role, you will be responsible for:

• Pentesting web applications, APIs, mobile applications, etc for our clients across a range of industries.

• Acting as the subject matter expert on application security, working with stakeholders of both a technical and non-technical nature to assist in support in vulnerability remediation and prevention.

• Acting as the go to point of contact for all things related to related to application security.

• Working with our in-house development team to build a next generation Application Security product.

• Helping to keep the Cytix platform secure by performing regular penetration testing.

Collaborating with other teams in the business to ensure our clients get the best product and service experience possible.

What you'll bring

• 2+ years in Penetration Testing, Application Security Engineering, or a similar offensive security role.

• A passion for all things AppSec, you're great at finding vulnerabilities in applications and demonstrating their impact.

• Ability to work independently and take ownership over service delivery for clients.

• Comfortable working a smaller environment where decision are made quickly and pragmatically.

• Solid communication and consulting skills.

What you'll get

• Time off that works for you: Unlimited holiday policy, including a guaranteed 33 days plus your birthday off

• Flexible hybrid working: Work in a way that helps you do your best work, while staying connected with the team.

• A stake in what we’re building: Eligible employees can participate in our EMI share option scheme.

• Healthcare that goes further: After one year’s service, access private healthcare through Vitality, including dental, optical, hearing and therapy cover.

• More ways to get around: Access our company car salary-sacrifice scheme.

• Support for growing families: Enhanced maternity and paternity leave.

• Opportunities to attend security conferences including BSides, OWASP Chapters and BlackHat Europe / USA

Our hiring process

• Screening call - Talent Acquisition - 30 minutes

• First stage - Hiring manager - 30 minutes

• Second stage - Technical - 120 mins

• Final stage - onsite in Manchester / Values with the founding team - 90 mins

We move the stages quickly and cover travel costs for the final stage onsite no-matter where you live in the UK - Flight, train or petrol for your car!

About Cytix

• Software never stops changing. Teams ship new code every day, through tickets, pull requests, releases, and increasingly with AI in the mix, but the way security keeps up with all that change hasn't really moved on.

• That's the problem we're solving. Cytix helps organisations understand which software changes actually matter, what should happen next, and how to prove the right call was made. Security understood, in other words.

• We're a small team with big plans, so every person we hire genuinely shapes what Cytix becomes. That's why we're upfront about our five values: we interview for all of them, and they matter to us more than a perfect CV. They're things you do, not things you are, so have a read and see if they sound like you.

Make the first move. When the goal is clear but the path isn't, you get moving rather than waiting for perfect instructions. If you're blocked, you make a sensible call, say what you're assuming, and explain how you'd course-correct. We'd rather you act and be slightly wrong than sit still.

Find the smarter path. You ask why before how. You dig into what the real problem is instead of just building what the spec says, and you're happy to question 'that's how it's always been done' when the reason behind it has gone stale.

See it through. When something's yours, it lands. No loose ends, no surprises for whoever picks it up next. You keep people posted when things change, and if something falls between roles, you catch it.

Raise the bar. You do the best job possible in the time you've got, whether that's a day or a month. Sometimes that means deep craft; sometimes the smartest move is quick and scrappy. It's about good judgement, and we hold each other to it without blame or politics.

Play to win. You care about the mission but don't take yourself too seriously. You say 'I' when things go wrong and 'we' when they go right, trust teammates to do things their own way, and bring a bit of humour when the pressure's on.

Sound like you on a normal working day? We'd love to meet you.