Penetration Tester & AI Security Engineer

About Javelin 

Javelin Global Commodities is a leading global commodities marketing, trading, logistics services and investment firm with head offices in London and wider global offices in New York, Dallas, San Diego, St Louis, Canada, Switzerland, Poland, Dubai, India, Singapore, China and Australia. Javelin was founded in 2015 and now operates across six continents with respect to more than 20 different commodities across thermal coal, metallurgical coal, iron ore, steel scrap, metals, hydrocarbons, freight, softs, and renewables. 

Established in 2015, Javelin employs over 200 people and is a unique place to grow your career. We take pride in our values, global reach, meritocratic culture and strong work ethic.  Our success over the years has been built on our guiding principles of customer service, creativity, transparency, integrity, and responsibility.  

Whilst our footprint grows, we still foster a small-company atmosphere. We have a flat company structure and encourage collaboration across all seniority levels, teams and locations to generate the best ideas. Javelin has a dedicated strategy to support local and meaningful charities through volunteer days, donation matching, a ‘give as you earn’ scheme and other fundraising activities. We are committed to the wellbeing of our colleagues and organise various social evenings, sports clubs and lunchtime activities.  Our London office has on-site gym facilities and a golf/sports simulator. Discover more at http://www.javelincommodities.com/. 

The Role 

Javelin is looking for a Penetration Tester & AI Security Engineer to join our London Infrastructure team, responsible for identifying and validating security weaknesses across Javelin’s infrastructure, applications and emerging AI capabilities. This is a new role that combines traditional penetration testing with AI security testing, secure AI development and the security assessment of new client-facing solutions. The individual will work closely with Infrastructure, development teams, business stakeholders and external security partners to identify vulnerabilities, demonstrate their potential impact and support their remediation. A key part of the role will be helping Javelin adopt AI technologies securely, including developing approved in-house AI solutions, testing AI security controls, conducting AI red-team exercises and ensuring AI applications and agents operate within clearly defined security and data-access boundaries. There will also be the opportunity to support new client engagements by performing authorised security testing of new platforms, applications and integrations, helping ensure security is built in from initial design through to production. The role is based full time in Javelin’s London office, a short walk from Victoria train and bus station.

Key Responsibilities Include: 

• Conduct penetration testing across Javelin’s infrastructure, applications, networks, Active Directory and cloud environments. 

• Identify vulnerabilities, demonstrate their potential impact and work with Infrastructure teams on remediation and retesting. 

• Perform authorised security testing of new client-facing platforms, applications and integrations before they go live, and provide security sign-off recommendations. 

• Support the secure development of in-house AI solutions, including AI agents, automation and integrations, using Microsoft Copilot Studio, Azure AI services and other approved platforms. 

• Ensure AI solutions follow Javelin’s security, privacy, access-control and data-protection requirements. 

• Test AI security controls, including prompt injection, data leakage, excessive permissions and attempts to bypass AI guardrails. 
• Conduct controlled AI red-team testing to identify weaknesses in AI applications and agents. 
• Test that AI systems respect existing user permissions and cannot expose confidential Javelin or client information. 
• Review AI identities, API permissions and access to systems such as Microsoft 365, Azure and corporate data. 
• Help develop Javelin’s standards for secure AI development, testing and deployment, and produce clear technical findings and management-level reporting with practical recommendations for remediation. 

Skills and Experience Required 

• Proven experience in penetration testing across infrastructure, web applications, APIs and cloud environments 

• Strong knowledge of Active Directory, Microsoft Entra ID, Microsoft 365, Azure and AWS, as well as networking and Windows/Linux 

• Experience with application security tools and concepts such as Burp Suite, OAuth/OIDC, REST APIs and secure development principles 

• Understanding of AI and large language model security, including prompt-injection testing, AI red teaming, data-leakage and access-control testing, and OWASP AI security guidance 

• Scripting ability in PowerShell and/or Python; experience with Microsoft Copilot Studio or Azure AI is desirable 

• Ability to communicate technical findings clearly and with confidence to all levels of the business. 

• Annual discretionary bonus
• 25 days holiday
• Company pension scheme (10% company contribution)
• Private medical scheme with a range of additional wellbeing benefits
• Travel insurance
• Income protection
• Life insurance (5x salary)
• Bike2Work scheme including secure storage and showers
• Season ticket loan
• Onsite gym