Senior Security Testing Infrastructure Engineer

Senior Security Testing Infrastructure Engineer

Location: Full Remote

About the Role

We are looking for a Senior Security Testing Infrastructure Engineer to join an offensive security team at a global financial institution. This is not a penetration testing role. You will be responsible for building, maintaining, and optimising the entire technical backbone that the penetration testing team relies on to do their work - laboratories, tools, automation pipelines, and supporting infrastructure.

If you enjoy engineering robust, secure environments and want your work to directly enable a world-class offensive security function, this role is for you.

What You Will Do

• Maintain and manage penetration testing infrastructure, including workstations, servers, virtual environments, and specialised hardware
• Administer internal security testing platforms (scanning engines, attack simulation tools, reporting systems), ensuring availability, stability, and performance
• Develop and maintain automation scripts, CI/CD pipelines, and tooling to improve testing efficiency and repeatability
• Manage test lab environments - provisioning, configuration management, access control, and secure data handling
• Perform patch management, software updates, and licensing oversight across the security testing ecosystem
• Troubleshoot infrastructure issues to minimise disruption to project delivery
• Ensure testing infrastructure complies with internal security policies, regulatory requirements, and data protection standards
• Maintain clear documentation of lab architecture, configurations, and operational procedures
• Support vendor evaluation and onboarding of new security testing technologies
• Collaborate with security, IT, and engineering teams on continuous improvement of testing capabilities

What We Are Looking For

Infrastructure & Systems

• Advanced Linux (RHEL) and Windows Server administration
• Virtualisation - VMware, Hyper-V, or equivalent
• Cloud awareness - AWS or Azure (foundational level)
• Container technologies - Docker, Kubernetes (desirable)
• Asset management and configuration baseline maintenance

Automation & Tooling

• Scripting - Python, Bash, PowerShell - Expert level
• Infrastructure as Code - Terraform, Ansible - Expert level
• CI/CD pipelines - GitLab CI, Jenkins, or equivalent - Expert level
• Version control - Git / GitLab / GitHub
• Integration of security tools with ticketing and reporting platforms (e.g. Jira)
• HashiCorp Vault (desirable)

Security Knowledge

• Familiarity with offensive security tooling ecosystems (scanning engines, attack simulation platforms)
• Understanding of web application security standards - OWASP, CWE, CVE
• Ability to validate vulnerabilities and eliminate false positives
• Secure handling of sensitive testing data - credentials, exploit artefacts, production test data
• Basic understanding of exploitation and proof-of-concept development (Core level)

Compliance & Governance

• Experience working in a regulated environment - banking or financial services preferred
• Ability to produce clear technical documentation in English
• Familiarity with access control principles, segregation of duties, and data protection standards
• Comfort with audit processes and internal governance frameworks

What This Role Is Not

This position does not involve conducting penetration tests, assessing client systems, or producing vulnerability assessment reports. Candidates looking for an active red team or pen testing role should look elsewhere. This role is for someone who wants to build the machine - not operate it.

Nice to Have

• RHCSA (Red Hat Certified System Administrator)
• AWS Cloud Practitioner or equivalent
• Certified Kubernetes Administrator (CKA)
• HashiCorp Terraform Associate
• Experience with air-gapped or highly isolated environments
• Background in Tier-1 financial institutions

Language Requirements

English - professional working proficiency, written and spoken. You will be producing technical documentation and communicating with global stakeholders.