{"id":77121,"url":"https://alion.io/job/wpp-product-application-and-offensive-security-engineer","title":"Penetration Tester","company":{"id":5467,"name":"WPP","domain":"wpp.com","url":"https://alion.io/company/wpp","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":88,"open_postings":34,"ghost_share":0,"stale_share":0.5,"repost_share":0,"time_to_fill_p50_days":56,"computed_at":"2026-10-19T05:45:15Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":60000,"max_usd":136000,"period":"year","method":"role_country_seniority_unknown","sample_n":140},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"Red Teaming","optional":false}],"status":"live","first_seen_at":"2026-07-03T12:54:51Z","employer_posted_date":"2026-09-08","last_verified_at":"2026-10-19T21:42:18Z","board_verified":true,"closed_at":null,"days_open":108,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":108},"description":"WPP is the trusted growth partner for the world’s leading brands. \nWe unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company - powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth. \n\nWe work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.\n\nOur people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow. \n\nFor more information, visit WPP.com.\n\n Department: Data & Technology Solutions (DTS)\nReports To: SVP Security and Compliance\nLocation: [London/Hybrid 2 days a week in office]\n Position Type: Full-Time\nRole Overview\nThe Product, Application and Offensive Security Engineer is responsible for embedding security directly into the design, development, testing, and operation of DTS products and platforms.\nThis is a hands-on security engineering role. The role requires someone who can work directly with product and engineering teams, review designs, assess APIs, run threat models, test systems, coordinate penetration testing, identify vulnerabilities, and help teams remediate issues.\nThe role ensures DTS products, APIs, data collaboration capabilities, AI-enabled workflows, and client-facing services are designed, built, and tested securely. It also owns the practical offensive security and adversarial assurance activity needed to test DTS products from an attacker’s perspective.\nThe Product, Application and Offensive Security Lead will work closely with Product, Engineering, Architecture, Infrastructure, Security Operations, Privacy, Cloud and Platform Security, and the ISMS and Risk Officer to ensure security issues are identified early, fixed effectively, and tracked through governance where required.\nKey Responsibilities\n1. Hands-on Product and Application Security\nProvide hands-on security support across DTS products and engineering teams. This includes:\nReviewing product designs, technical designs, APIs, services, and integrations.\nIdentifying security weaknesses in applications, workflows, and data flows.\nAdvising engineering teams on secure implementation.\nSupporting secure design decisions during product discovery and delivery.\nHelping teams resolve security issues pragmatically without creating unnecessary delivery friction.\n2. Secure Software Development Lifecycle (SDLC)\nEmbed security into the software development lifecycle across DTS. This includes:\nDefining and applying secure engineering standards.\nSupporting secure coding practices.\nReviewing CI/CD security controls.\nSupporting SAST, DAST, SCA, secrets scanning, dependency scanning, and container scanning.\nHelping teams triage, prioritise, and remediate security findings.\nWorking with engineering teams to make security checks practical and repeatable.\n3. Threat Modelling and Security Design Reviews\nRun threat modelling and security design reviews for new and changed capabilities. This includes:\nFacilitating threat modelling sessions with engineering and product teams.\nReviewing authentication and authorization designs.\nAssessing API exposure, data flows, trust boundaries, and abuse cases.\nIdentifying risks around tenant isolation, privilege escalation, data leakage, and misuse.\nDocumenting key findings, recommendations, and residual risks.\n4. Offensive Security and Adversarial Testing\nCarry out and coordinate offensive security testing across DTS products and platforms. This includes:\nPerforming hands-on security testing of products, APIs, and workflows.\nCoordinating external penetration tests.\nSupporting red team and purple team exercises where required.\nTesting abuse cases and attacker paths.\nTesting access control, authentication, authorization, and data leakage risks.\nValidating remediation of security findings.\nFeeding material risks into the ISMS and Risk Officer for tracking.\n5. API, Integration and Data Product Security\nProvide security assurance for APIs, integrations, and data products. This includes:\nReviewing externally exposed APIs and partner integrations.\nAssessing rate limiting, authorization, tenant isolation, logging, abuse prevention, and data leakage controls.\nSupporting secure integration between InfoSum, Open Intelligence, Resolve, WPP Open, and third-party platforms.\nReviewing data product workflows for misuse, excessive access, or unintended exposure.\nWorking with Privacy Engineering on privacy-sensitive APIs, algorithms, and outputs.\n6. AI and Agentic Security Testing\nProvide hands-on security review and adversarial testing for AI-enabled and agentic capabilities. This includes:\nTesting prompt injection, tool misuse, data leakage, and excessive agency.\nReviewing how agents access APIs, data, tools, and workflows.\nTesting whether agent permissions can be bypassed or escalated.\nAssessing action boundaries and human approval points.\nWorking with Identity, AI, and Data Access Governance to validate agent access models.\nDocumenting AI and agentic security risks and remediation actions.\n7. Vulnerability Triage and Remediation Support\nHelp teams understand, prioritise, and fix security vulnerabilities. This includes:\nReviewing vulnerability findings from scans, penetration tests, code reviews, cloud tools, and external reports.\nPrioritising findings based on exploitability, exposure, data sensitivity, and business impact.\nWorking directly with engineers to define remediation options.\nValidating that fixes are effective.\nSupporting exception and risk acceptance decisions where remediation is delayed.\nEnsuring significant issues are visible through the DTS risk process.\n8. Engineering Enablement and Security Coaching\nAct as a practical security partner to engineering teams. This includes:\nProviding secure implementation guidance.\nCreating lightweight security patterns and examples.\nCoaching engineers on common application, API, and AI security risks.\nHelping teams understand the “why” behind security requirements.\nSupporting a culture where security is part of product quality, not a separate approval gate.\nKey Accountabilities\nThe Product, Application and Offensive Security Lead will be accountable for:\nHands-on application and product security support across DTS.\nSecure SDLC guidance and practical adoption.\nThreat modelling and security design reviews.\nAPI, integration, and data product security reviews.\nOffensive security and adversarial testing activity.\nAI and agentic security testing.\nVulnerability triage, remediation guidance, and fix validation.\nCoordination with ISMS/Risk to ensure material risks and exceptions are tracked.\nHelping engineering teams build secure systems without unnecessary delivery drag.\nSkills and Experience\nThe successful candidate will have:\nStrong hands-on experience in application security, product security, offensive security, security engineering, or penetration testing.\nGood understanding of modern software engineering, APIs, SaaS platforms, distributed systems, and cloud-native applications.\nExperience with threat modelling and secure design reviews.\nPractical knowledge of common application and API security risks, including authentication, authorization, tenant isolation, injection, data leakage, privilege escalation, and supply chain risk.\nExperience using security testing tools and techniques across web applications, APIs, cloud services, and CI/CD pipelines.\nFamiliarity with SAST, DAST, SCA, secrets scanning, dependency scanning, and vulnerability management workflows.\nExperience working directly with engineers to remediate findings.\nUnderstanding of AI and agentic security risks would be highly valuable.\nAbility to communicate clearly with engineering, product, architecture, security, and leadership stakeholders.\nA pragmatic, delivery-aware approach to security.\nLeadership Expectations\nThe Product, Application and Offensive Security Engineer is expected to:\nBe hands-on and technically credible with engineering teams.\nAct as a trusted security partner, not just a reviewer or approver.\nChallenge insecure designs constructively.\nHelp teams find practical ways to reduce risk.\nPrioritise issues based on real-world exploitability and business impact.\nWork across multiple DTS product areas without becoming a delivery bottleneck.\nEscalate material risks clearly through the appropriate governance routes.\nPromote secure engineering habits through practical guidance and example.\nSuccess Measures\nSuccess in the role will be measured by:\nSecurity being embedded earlier in product and engineering delivery.\nReduction in high-risk application, API, and product vulnerabilities.\nRegular threat modelling and security reviews for critical DTS capabilities.\nEffective offensive and adversarial testing of products, APIs, and workflows.\nFaster remediation of penetration test and security testing findings.\nImproved security assurance for AI and agentic workflows.\nEngineering teams receiving practical, actionable security guidance.\nMaterial security risks being surfaced and tracked through the DTS risk process.\nSecurity being viewed by engineering teams as an enabler of trusted delivery rather than a blocker.\nYou're open: We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.\nYou're optimistic: We believein the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected.\nYou're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.\nWhat we'll give you:\nPassionate, inspired people - We aim to create a culture in which people can do extraordinary work.\nScale and opportunity - We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry.\nChallenging and stimulating work - Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge?\n#LI-Hybrid \nWe believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.\nWPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers.\nPlease read our Privacy Notice (https://www.wpp.com/en/careers/wpp-privacy-policy-for-recruitment) for more information on how we process the information you provide.","description_format":"text","description_chars":11287,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Creative Agencies","Digital Marketing","Media & Audience Measurement"],"lifecycle":[{"event":"open","at":"2026-07-03T12:54:51Z"}],"visa":[],"liveness":{"score":10,"band":"cold","label":"Long shot","p_open":1,"p_active":0.273,"p_room":0.36,"age_days":107,"expected_fill_days":56,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/wpp-product-application-and-offensive-security-engineer","json_url":"https://alion.io/job/wpp-product-application-and-offensive-security-engineer.json","meta":{"generated_at":"2026-10-19T23:40:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2474,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5467},"rest":"https://alion.io/mcp/rest/get_company?id=5467"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fwpp-product-application-and-offensive-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fwpp-product-application-and-offensive-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fwpp-product-application-and-offensive-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/wpp-product-application-and-offensive-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fwpp-product-application-and-offensive-security-engineer"}]}