Location
10 Upper Bank St, Canary Wharf, London

Hours
Hybrid working with the expectation to attend the office as business needs require

Salary
Negotiable

About the Role
This role reports to the Head of Information Security and requires a fast-learning, self-motivated individual to enhance capability and capacity within a small but highly effective team. You will play a key part in implementing and improving structured, systematic, and audited approaches to Information Security across the firm. The role focuses on conducting thorough Red Team offensive penetration testing on both on-premises and cloud infrastructure to identify vulnerabilities and recommend remediation. You will perform security assessments on cloud-based applications, IoT devices, SmartBuilding digital landscapes, data lakes, and web-based APIs, ensuring adherence to industry standards and best practices.

You will execute red team exercises simulating real-world attack scenarios to test detection and response capabilities, collaborate with cross-functional teams to enhance the firm's security posture, and prepare detailed reports for technical and non-technical stakeholders. Staying informed on the latest security trends and threats is essential to proactively address risks.

Additional responsibilities include supporting security certification activities such as ISO27001, SOC2, and Cyber Essentials Plus, assisting with audits and documentation, engaging with external industry partners, and driving continuous improvements in security testing processes. You will also empower colleagues to become informed security contacts and help resolve security issues within the firm.

This pivotal role offers the opportunity to work within an innovative, diverse, and ambitious team at one of the world’s largest international law firms, committed to delivering world-class service and maintaining a strong security posture aligned with business objectives.

Experience
Comprehensive experience in security testing and red teaming, with the ability to communicate complex security concepts effectively. Proven background in conducting a wide range of security testing and red team activities, including penetration testing on IT infrastructure, cloud applications, IoT devices, and APIs. Experience coordinating external security requirements and delivering actionable results that align with business needs. Familiarity with structured documentation, process management, and version control is important.

Experience engaging with stakeholders at various seniority levels and balancing information gathering with risk assessment is essential. Exposure to external clients and maintaining positive working relationships in challenging circumstances is desirable.

About you
Self-motivated, fast learner with strong organisational skills to manage and prioritise multiple concurrent assignments. Ability to work collaboratively across teams and empower colleagues on security matters. Demonstrates an entrepreneurial spirit and conscientious approach to work. Committed to continuous learning and staying updated on emerging threats and security technologies.

Qualifications
A degree-level education is likely but not essential. Professional certifications such as CREST, CHECK, OSCP, OSWE, OSWA, or full membership status with the IISP are highly advantageous. The role may require security clearance in the future. Knowledge and experience supporting security certification standards like ISO27001, SOC2, and Cyber Essentials Plus is beneficial.