Penetration Tester

WPP, United Kingdon +1

The role

Department: Data & Technology Solutions (DTS)
Reports To: SVP Security and Compliance
Location: [London/Hybrid 2 days a week in office]
Position Type: Full-Time

Role Overview

The Product, Application and Offensive Security Engineer is responsible for embedding security directly into the design, development, testing, and operation of DTS products and platforms.

This is a hands-on security engineering role. The role requires someone who can work directly with product and engineering teams, review designs, assess APIs, run threat models, test systems, coordinate penetration testing, identify vulnerabilities, and help teams remediate issues.

The role ensures DTS products, APIs, data collaboration capabilities, AI-enabled workflows, and client-facing services are designed, built, and tested securely. It also owns the practical offensive security and adversarial assurance activity needed to test DTS products from an attacker’s perspective.

All jobs

Penetration Tester

WPP, United Kingdon +1

The role

Department: Data & Technology Solutions (DTS)
Reports To: SVP Security and Compliance
Location: [London/Hybrid 2 days a week in office]
Position Type: Full-Time

Role Overview

The Product, Application and Offensive Security Engineer is responsible for embedding security directly into the design, development, testing, and operation of DTS products and platforms.

What you will do

Hands-on Product and Application Security

Provide hands-on security support across DTS products and engineering teams. This includes

Reviewing product designs, technical designs, APIs, services, and integrations.
Identifying security weaknesses in applications, workflows, and data flows.
Advising engineering teams on secure implementation.
Supporting secure design decisions during product discovery and delivery.
Helping teams resolve security issues pragmatically without creating unnecessary delivery friction.
Secure Software Development Lifecycle (SDLC)

Embed security into the software development lifecycle across DTS. This includes

Defining and applying secure engineering standards.
Supporting secure coding practices.
Reviewing CI/CD security controls.
Supporting SAST, DAST, SCA, secrets scanning, dependency scanning, and container scanning.
Helping teams triage, prioritise, and remediate security findings.
Working with engineering teams to make security checks practical and repeatable.
Threat Modelling and Security Design Reviews

Run threat modelling and security design reviews for new and changed capabilities. This includes

Facilitating threat modelling sessions with engineering and product teams.
Reviewing authentication and authorization designs.
Assessing API exposure, data flows, trust boundaries, and abuse cases.
Identifying risks around tenant isolation, privilege escalation, data leakage, and misuse.
Documenting key findings, recommendations, and residual risks.
Offensive Security and Adversarial Testing

Carry out and coordinate offensive security testing across DTS products and platforms. This includes

Performing hands-on security testing of products, APIs, and workflows.
Coordinating external penetration tests.
Supporting red team and purple team exercises where required.
Testing abuse cases and attacker paths.
Testing access control, authentication, authorization, and data leakage risks.
Validating remediation of security findings.
Feeding material risks into the ISMS and Risk Officer for tracking.
API, Integration and Data Product Security

Provide security assurance for APIs, integrations, and data products. This includes

Reviewing externally exposed APIs and partner integrations.
Assessing rate limiting, authorization, tenant isolation, logging, abuse prevention, and data leakage controls.
Supporting secure integration between InfoSum, Open Intelligence, Resolve, WPP Open, and third-party platforms.
Reviewing data product workflows for misuse, excessive access, or unintended exposure.
Working with Privacy Engineering on privacy-sensitive APIs, algorithms, and outputs.
AI and Agentic Security Testing

Provide hands-on security review and adversarial testing for AI-enabled and agentic capabilities. This includes

Testing prompt injection, tool misuse, data leakage, and excessive agency.
Reviewing how agents access APIs, data, tools, and workflows.
Testing whether agent permissions can be bypassed or escalated.
Assessing action boundaries and human approval points.
Working with Identity, AI, and Data Access Governance to validate agent access models.
Documenting AI and agentic security risks and remediation actions.
Vulnerability Triage and Remediation Support

Help teams understand, prioritise, and fix security vulnerabilities. This includes

Reviewing vulnerability findings from scans, penetration tests, code reviews, cloud tools, and external reports.
Prioritising findings based on exploitability, exposure, data sensitivity, and business impact.
Working directly with engineers to define remediation options.
Validating that fixes are effective.
Supporting exception and risk acceptance decisions where remediation is delayed.
Ensuring significant issues are visible through the DTS risk process.
Engineering Enablement and Security Coaching

Act as a practical security partner to engineering teams. This includes

Providing secure implementation guidance.
Creating lightweight security patterns and examples.
Coaching engineers on common application, API, and AI security risks.
Helping teams understand the “why” behind security requirements.
Supporting a culture where security is part of product quality, not a separate approval gate.

Key Accountabilities

The Product, Application and Offensive Security Lead will be accountable for

Hands-on application and product security support across DTS.
Secure SDLC guidance and practical adoption.
Threat modelling and security design reviews.
API, integration, and data product security reviews.
Offensive security and adversarial testing activity.
AI and agentic security testing.
Vulnerability triage, remediation guidance, and fix validation.
Coordination with ISMS/Risk to ensure material risks and exceptions are tracked.
Helping engineering teams build secure systems without unnecessary delivery drag.

Penetration Tester

The role

Penetration Tester

The role

What you will do

Provide hands-on security support across DTS products and engineering teams. This includes

Embed security into the software development lifecycle across DTS. This includes

Run threat modelling and security design reviews for new and changed capabilities. This includes

Carry out and coordinate offensive security testing across DTS products and platforms. This includes

Provide security assurance for APIs, integrations, and data products. This includes

Provide hands-on security review and adversarial testing for AI-enabled and agentic capabilities. This includes

Help teams understand, prioritise, and fix security vulnerabilities. This includes

Act as a practical security partner to engineering teams. This includes

The Product, Application and Offensive Security Lead will be accountable for

The successful candidate will have

The Product, Application and Offensive Security Engineer is expected to

Success in the role will be measured by

What we'll give you

About WPP

Similar jobs at other companies

Penetration Tester

Senior Penetration Tester

Penetration Tester

Senior Product Security Engineer

Product Security Engineer

Lead Security Engineer

Interview questions

WPP