Security Assurance Penetration Tester

About the role

We are looking for a collaborative Penetration Tester to join Elsevier’s Security Engineering team within relx. In this hands‑on position you will execute offensive security testing, validate vulnerabilities, and help automate security assurance processes in a fast‑paced, mission‑driven environment.

Key responsibilities

• Track and triage findings from third‑party assessments, ensuring timely remediation.
• Work with development, platform, and product teams to communicate findings and improve security posture.
• Facilitate post‑assessment reviews and lessons‑learned sessions to promote secure development practices.
• Maintain program documentation, test records, and reporting artifacts.
• Conduct penetration testing of web applications, APIs, cloud environments, and internal systems, escalating complex scenarios as needed.
• Perform peer reviews of penetration testing deliverables, including test plans, findings, and final reports.
• Participate in scoping exercises and select appropriate testing methodologies.
• Support security assessments of GenAI‑powered applications, including LLM integrations and AI agents.
• Assist in testing for AI‑specific vulnerabilities such as prompt injection, jailbreaking, and model data leakage.
• Contribute to internal GenAI security testing checklists aligned with OWASP Top 10 for LLMs.

Required profile

• Experience in information security, penetration testing, or a related field.
• Relevant security certification (e.g., Security+, eJPT, PNPT, CEH) preferred; OSCP a plus.
• Foundational understanding of web application architecture, networking, and operating system security.
• Basic knowledge of cloud environments (AWS, Azure, or GCP) and associated security considerations.

Required skills

• Penetration testing tools: Burp Suite, Nmap, Metasploit, Nuclei.
• Scripting languages: Python, Bash, PowerShell.
• Security frameworks: OWASP Top 10, CVSS.
• Familiarity with SAST/DAST tools.
• Cloud platforms: AWS, Azure, GCP.