Job Title

Web Application & Infrastructure Penetration Tester

Department: Cyber Security
Location: Remote

About the Role

Introduction

At Oxford University Press, we are passionate about advancing learning, education, and research worldwide. As a Cyber Security & Resilience Testing Specialist, you will play a critical role in protecting our digital platforms, services, and data while supporting our mission to make a positive impact through education.

This is an exciting opportunity for an experienced penetration testing professional to join a collaborative and highly skilled Cyber Security team. You will work across a diverse technology landscape, testing modern web applications, APIs, cloud services, mobile applications, and supporting infrastructure. The role offers exposure to a variety of technologies and security challenges, allowing you to continuously develop your expertise while helping strengthen OUP's security posture.

If you are naturally curious, enjoy solving complex security challenges, and are passionate about offensive security and continuous learning, this role offers the opportunity to make a tangible impact across the organisation.

Opportunity

As a Cyber Security & Resilience Testing Specialist, you will:

• Conduct comprehensive penetration testing activities across web applications, APIs, cloud-native services, mobile applications, and supporting infrastructure.
• Identify, exploit, validate, and document security vulnerabilities, particularly those aligned to the OWASP Top 10 framework.
• Perform Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) to identify insecure coding practices and runtime vulnerabilities.
• Assess API security, including authentication, authorisation, and data exposure risks.
• Conduct security testing of iOS and Android mobile applications and their supporting backend services.
• Produce high-quality technical reports that clearly communicate findings, risks, and practical remediation recommendations.
• Collaborate with development, infrastructure, and business teams to support remediation activities and improve security outcomes.
• Contribute to the enhancement of security testing methodologies, standards, and best practices across the organisation.
• Support the ongoing development of OUP's cyber resilience capabilities through proactive identification and management of security risks.

Impact

This role is essential in helping OUP identify and address security weaknesses before they can be exploited. Your expertise will directly contribute to protecting business-critical systems, sensitive information, digital products, and services used by learners, educators, researchers, and employees around the world. Through your work, you will help strengthen organisational resilience and support the delivery of secure and trusted digital experiences.

About You

Essential Criteria

• Demonstrable experience conducting manual and automated penetration testing of modern web applications and supporting infrastructure.
• Strong knowledge of application security principles and vulnerability assessment techniques.
• Deep understanding of the OWASP Top 10 and experience identifying, exploiting, validating, and reporting vulnerabilities across all categories.
• Experience testing applications developed using technologies such as:
  • .NET / ASP.NET
  • Java / Spring
  • Node.js
  • Python frameworks
  • PHP frameworks
  • React, Angular, Vue.js, and other JavaScript front-end technologies
  • REST and GraphQL APIs
  • Single Page Applications (SPAs)
• Experience performing API security assessments.
• Strong written and verbal communication skills, with the ability to present technical findings to both technical and non-technical audiences.
• Experience using industry-standard security testing tools, including:
  • Kali Linux
  • Nmap
  • Burp Suite Professional

Desirable Criteria

• Experience with additional security testing tools such as:
  • OWASP ZAP
  • JWT Toolkits
  • ffuf
  • Dirb, GoBuster, Feroxbuster
  • Metasploit
  • CrackMapExec / NetExec
  • WPScan
  • CMSMap
  • SQLMap
  • Nuclei
  • Wafw00f / LBD
• Experience conducting mobile application security testing across iOS and Android platforms.
• Degree in Computer Science, Information Security, or a related discipline.
• Industry certifications such as OSCP, CEH, CISSP, or equivalent.

Key Attributes

• Naturally inquisitive, with a desire to investigate beyond the obvious and gain deeper understanding of systems and risks.
• Analytical and methodical approach to solving complex problems.
• Ability to translate technical security concepts into practical business-focused recommendations.
• Strong stakeholder engagement and communication skills.
• Adaptable, proactive, and committed to continuous professional development.
• Self-motivated with a focus on delivering high-quality outcomes.

Queries

Please contact aarti.rana@oup.com with any queries relating to this role. To ensure a smooth application process, please submit your CV through the application link rather than via email.

Diversity & Inclusion

We are committed to supporting diversity in our workforce and ensuring an inclusive environment where all individuals can thrive. We seek to employ a workforce representative of the markets that we serve and encourage applications from all backgrounds.

Salary

Dependent on skills and experience.