Cyber Security Tester

Powered by Water, Driven by Purpose

South West Water keeps the South West flowing with safe, reliable drinking water and wastewater services across some of the UK’s most stunning landscapes.

We’re proud to be part of Pennon Group, a leader in the UK water sector, working towards a greener future. Our goals? As well as lowering our carbon footprint, we’re working with partners to plant 300,000 trees, restore peatlands and supporting farmers and landowners to improve water quality and wildlife.

Whether you’re starting out or seeking a new challenge, our scale and ambition create opportunities for you to shape your own career.

Ready to make a splash? Join our team today.

Cyber Security Tester (known internally as Security Testing & Assurance Specialist)

Location: Exeter / Hybrid Working
Salary: Up to £45,000 depending on experience & excellent benefits package
Security Clearance: Must hold, or be eligible to obtain and maintain, UK Security Check (SC) clearance

Help protect critical services that millions rely on every day

We're looking for a Security Testing & Assurance Specialist to join our Cyber Security team and play a key role in strengthening the resilience of our technology estate. This is an exciting opportunity for an experienced cyber security professional who enjoys combining hands-on technical testing with strategic assurance activities across enterprise IT and operational technology environments.

You'll work across a diverse range of technologies, helping to identify vulnerabilities, validate security controls and ensure our systems, people and processes are prepared to defend against evolving cyber threats.

What you'll be doing

As a Security Testing & Assurance Specialist, you'll be responsible for planning, coordinating and delivering a broad range of security testing and assurance activities, including:

• Defining risk-based security testing strategies and assurance plans for projects, programmes and operational services.

• Reviewing solutions, architectures and technical designs to identify security weaknesses and testing requirements.

• Conducting application, web, API, infrastructure, cloud, network and identity security assessments.

• Identifying vulnerabilities, attack paths and security risks, recommending remediation actions and validating closure.

• Planning and delivering adversary simulations, red team-style assessments, purple team exercises and blue team validation activities.

• Testing monitoring, logging, detection and incident response capabilities against recognised threat behaviours.

• Designing and facilitating tabletop exercises, crisis management simulations, cyber recovery exercises and executive cyber scenarios.

• Producing high-quality technical and executive-level reports, documenting findings, risks and recommendations.

• Tracking remediation activities and supporting risk treatment through to completion.

• Maintaining testing standards, procedures, metrics, dashboards and evidence required for audits and regulatory assurance.

• Collaborating with OT specialists to safely deliver assurance activities across operational technology environments.

What we're looking for

We're interested in candidates with demonstrable experience across several of the following areas:

• Security testing, penetration testing, security assurance, red teaming, security operations or a related cyber security discipline.

• Application, web, API, cloud, infrastructure or network security assessments.

• Identifying and communicating technical vulnerabilities, attack paths and control weaknesses.

• Producing technical and executive-facing security reports and recommendations.

• Working with project teams, architects and technical stakeholders to validate security controls and remediation activities.

• Planning, facilitating or participating in cyber security exercises and simulations.

• Supporting threat emulation, adversary simulation, detection validation or purple team activities.

• Using scripting and automation tools such as PowerShell, Python or Bash.

• Engaging confidently with both technical and non-technical stakeholders.

Essential knowledge and skills

• Strong understanding of application security testing and common vulnerabilities.

• Knowledge of infrastructure, cloud, network and identity security concepts.

• Familiarity with:

  • OWASP Testing Guide

  • OWASP Top 10

  • MITRE ATT&CK Framework

  • NCSC Cyber Security Guidance

  • NIST Cybersecurity Framework

  • Cyber Kill Chain

• Ability to analyse complex risks and communicate findings clearly.

• Eligible to obtain and maintain UK SC Clearance.

Desirable experience & certifications

• Experience within utilities, water, energy, critical national infrastructure or other regulated sectors.

• OT / ICS security awareness and experience supporting regulatory assurance frameworks.

• Knowledge of NIS Regulations, CAF and ISO27001.

• Professional certifications such as:

  • CREST CRT, CCT or CCSAS

  • OSCP

  • CISSP

  • GIAC

  • Security+

  • Microsoft or Azure Security Certifications

Our Benefits

We believe in rewarding our people for their hard work and dedication. As our
Security Testing and Assurance Specialist you'll enjoy:

What we offer

• Attractive Salary & Benefits Package

• Annual Bonus Scheme – Recognising company performance

• Pension Scheme – Helping you plan for your future

• Hybrid Working – A blend of office and home working, supporting flexibility while maintaining collaboration with your team

• Employee Assistance Programme – Supporting your wellbeing

• Employee Discounts – Access to discounts on a range of products and services

• Annual Leave Allowance – Giving you time to rest and recharge

• Annual Leave Buy & Sell Scheme – Flexibility to purchase additional holiday or sell unused leave to suit your lifestyle

• Career Development Opportunities – Supporting your ongoing growth and development

Closing Date: 30th October 2026

We may close this vacancy early if we receive a high volume of applications. We encourage you to apply as soon as possible.

Please note that the successful candidate will be subject to a mandatory DBS check as part of the onboarding process.

Be yourself, we like it that way. Together, we will build a culture of belonging, where inclusion is instinctive. Diversity is our strength and a reflection of our communities. We care, we value everyone, we celebrate uniqueness.

Our core values, which are essential to our success, are:

Be Rock Solid - Build trust and be trusted. Be the one we all look to and can depend on.

Be You - We want you to bring your best everyday. Be yourself and make your mark in your individual way.

Be the Future - Embrace change. Drive Progress. Own the challenge.