Recon Engineer

Navigate to the next section

About the role

JUMPSEC is building a specialist Continuous Recon capability to help clients understand and reduce the security risks visible across their external digital footprint.

This is not a traditional vulnerability scanning role, and it is not a dashboard-watching role. Continuous Recon is about seeing organisations from an attacker’s perspective, investigating what is exposed, validating what matters, and turning ambiguous external signals into clear, actionable security insight.

As a Recon Engineer, you will work at the intersection of external attack surface discovery, vulnerability validation, OSINT, threat intelligence, and exposure analysis. You will investigate internet-facing assets, identify unknown or unmanaged infrastructure, validate potential weaknesses, and help clients understand which issues create meaningful risk.

You will be joining the service at an important stage in its growth. That means you will not simply inherit a static operating model. You will help shape how Continuous Recon works, how we investigate findings, how we validate exposure, how we report to clients, and how we build scalable research-led capability over time.

This role is well suited to someone who enjoys recon, external attack surface analysis, bug bounty methodologies, exposure research, internet infrastructure, and the process of turning scattered technical clues into a coherent picture. If you spend time thinking about how attackers enumerate targets, how exposed services can be chained together, how forgotten assets become initial access opportunities, or how to validate findings safely and defensibly, you will likely feel at home in this team.

The right person will combine technical curiosity with operational discipline. You will need to be comfortable with ambiguity, able to investigate independently, and capable of communicating findings clearly to both technical and non-technical audiences.

About Continuous Recon

Continuous Recon is JUMPSEC’s managed external reconnaissance and exposure reduction service.

The service gives clients a continuously maintained attacker’s-eye view of their external estate. It combines asset discovery, exposure monitoring, vulnerability validation, dark web and open-source intelligence, and analyst-led investigation to help clients reduce externally visible risk before it becomes an incident.

Continuous Recon helps clients answer questions such as:

  • What can attackers see from the outside?
  • Which assets are unknown, unmanaged, or unexpected?
  • Which exposures are genuinely meaningful?
  • Which findings require urgent action?
  • Where are we seeing recurring exposure patterns?
  • Is our external risk reducing over time?

The service is designed to go beyond raw scanner output. Our focus is on validation, prioritisation, evidence, and actionable client outcomes.

What Success Looks Like

A successful Recon Engineer will:

  • Identify meaningful external exposure that clients may not otherwise have seen.
  • Validate findings carefully and avoid creating noise.
  • Produce clear evidence that supports technical conclusions.
  • Help clients understand what matters and what to do next.
  • Improve the quality, consistency, and scalability of the Continuous Recon service.
  • Contribute to external threat hunts, research-led investigation, and reusable validation capability.
  • Build trust with colleagues and clients through strong judgement, clear communication, and reliable delivery.

Key Responsibilities

External Reconnaissance and Asset Discovery

  • Proactively identify, investigate, and track client internet-facing assets, including domains, subdomains, IP addresses, cloud-hosted services, web applications, exposed technologies, certificates, and related infrastructure.
  • Use a range of tools, techniques, and investigative methods to expand understanding of client digital footprints.
  • Identify unknown, unmanaged, legacy, third-party, or unexpected assets that may create external exposure.
  • Support the maintenance of accurate and reliable asset records, ensuring that client external estates are represented as clearly as possible.
  • Investigate changes in client exposure over time, including newly discovered assets, removed assets, recurring issues, and potential regressions.

Exposure Analysis and Vulnerability Validation

  • Investigate and validate externally visible findings, including misconfigurations, exposed services, vulnerable technologies, weak security posture, dangling DNS, public data exposure, leaked credentials, and other attacker-useful signals.
  • Assess whether findings are real, externally reachable, exploitable, relevant, and supported by evidence.
  • Apply safe and proportionate validation techniques, ensuring that testing remains controlled, defensible, and appropriate to the client context.
  • Translate technical observations into clear risk statements, remediation guidance, and actionable security outcomes.
  • Escalate urgent or material findings through the appropriate operational channels.

Client Reporting and Communication

  • Produce clear, concise, and actionable written outputs, including investigative notes, exposure summaries, technical findings, operational updates, and client-facing report content.
  • Communicate findings in a way that explains what was found, why it matters, how confident we are, and what the client should do next.
  • Engage professionally with clients through written updates, remote meetings, and face-to-face interactions where required.
  • Support routine service reporting by identifying meaningful trends, recurring exposure themes, remediation progress, and priority actions.

Operational Discipline and Service Improvement

  • Maintain accurate records, tickets, evidence, and investigative documentation.
  • Follow agreed processes for triage, validation, escalation, reporting, and quality assurance.
  • Identify opportunities to improve tooling, workflows, automation, data quality, reporting, and service consistency.
  • Contribute to internal documentation, playbooks, checklists, and knowledge sharing.
  • Help reduce manual effort by turning repeatable investigation patterns into standardised processes and reusable methods.
  • Operate effectively in a dynamic service environment with multiple clients, concurrent investigations, and changing priorities.

External Threat Hunting and Research

  • Support hypothesis-led external threat hunts across client estates.
  • Investigate emerging vulnerability trends, attacker recon techniques, exposed technology patterns, and client-relevant threat intelligence.
  • Collaborate with Threat Hunting and Cyber Threat Intelligence colleagues to connect external exposure with wider attacker behaviour.
  • Contribute to the development of repeatable validation methods, recon workflows, playbooks, and exposure checks.
  • Help build JUMPSEC’s capability to conduct external vulnerability research at scale.

Skills and Experience

Essential

 Technical Skills

  • Strong understanding of cyber security attack techniques, especially those related to external exposure, reconnaissance, initial access, and internet-facing infrastructure.
  • Strong investigative mindset, with the ability to analyse ambiguous external signals and determine whether they represent meaningful risk.
  • Good understanding of TCP/IP networking and common protocols, including HTTP, DNS, SMTP, SSH, RDP, SMB, and TLS.
  • Good understanding of web and internet security concepts, including common externally exposed services, web technologies, APIs, authentication patterns, and legacy technology stacks.
  • Experience using Linux-based tools and command-line workflows.
  • Experience with recon, OSINT, attack surface discovery, vulnerability triage, or exposure analysis.
  • Ability to gather, preserve, and explain technical evidence.
  • Ability to produce clear written technical outputs and client-facing summaries.
  • Strong documentation discipline and attention to detail.

Investigation and Analysis Skills

  • Ability to independently investigate technical findings from incomplete or imperfect information.
  • Ability to distinguish between raw observations, likely issues, confirmed findings, and unsupported assumptions.
  • Ability to assess exploitability, attacker utility, exposure, confidence, and remediation priority.
  • Ability to identify patterns, relationships, and anomalies across technical datasets.
  • Ability to manage multiple investigations and operational tasks without losing quality or context.

Communication Skills

  • Excellent written and verbal communication skills.
  • Ability to explain complex technical concepts clearly and accurately.
  • Ability to write findings that are useful to both technical teams and security leaders.
  • Confidence engaging with clients in written, remote, and face-to-face settings.
  • Ability to communicate uncertainty honestly and professionally.

Desirable

The following are not mandatory, but would be valuable:

  • Experience participating in bug bounty programmes or exposure-focused security research.
  • Familiarity with platforms such as HackerOne, Bugcrowd, Intigriti, or similar communities.
  • Experience with Python, Bash, Git, APIs, or data manipulation.
  • Familiarity with Attack Surface Management tooling, internet-wide scanning datasets, passive DNS, certificate transparency, Shodan, Censys, SecurityTrails, or similar sources.
  • Experience with OSINT methodologies, dark web monitoring, credential exposure investigation, or public data exposure analysis.
  • Exposure to Threat Hunting, Cyber Threat Intelligence, Incident Response, or Penetration Testing.
  • Understanding of cloud exposure patterns across Azure, AWS, or Google Cloud.
  • Understanding of common vulnerability classes affecting internet-facing systems.
  • Experience developing repeatable checks, scripts, tools, or validation workflows.
  • Willingness to undertake SC clearance.

Personal Attributes

We are looking for someone who is:

  • Curious and self-directed.
  • Comfortable with ambiguity.
  • Investigative by nature.
  • Technically rigorous.
  • Detail-oriented without losing sight of the bigger picture.
  • Able to prioritise effectively.
  • Calm and professional under pressure.
  • Willing to challenge assumptions.
  • Committed to continuous learning.
  • Able to work independently while contributing to a team.
  • Interested in building capability, not just completing tasks.

Benefits

  • Salary up to £45,000, dependent on candidate suitability.
  • 25 days annual leave, including your birthday off work.
  • 4 paid days for charity or community work.
  • Flexible hybrid working.
  • Annual training and research budget for conferences, courses, certifications, tooling, or structured learning.
  • Access to red team labs, testing infrastructure, CTI capability, and sandbox environments.
  • Opportunities to contribute to public research, tools, and community initiatives.
  • Supportive, skilled peers and a high-autonomy working environment.
  • Sensible management, meaningful work, and no micromanagement.

Company Culture

JUMPSEC is a technical cyber security company that values curiosity, quality, and practical impact.

We are building Continuous Recon as a specialist capability, not a commodity scanning function. That means we care about evidence, judgement, clear communication, and meaningful client outcomes.

You will work with people across reconnaissance, threat hunting, cyber threat intelligence, detection and response, penetration testing, incident response, and solutions engineering. You will have the opportunity to learn from experienced practitioners while helping shape a service that is still evolving.

We value people who want to understand how things really work, who take pride in clear thinking, and who want their work to make clients more secure in practical, measurable ways.

Why Join The JUMPSEC Continuous Recon Team

This is a rare opportunity to join a growing reconnaissance function while it is still being shaped.

You will not be joining a rigid, mature service where every decision has already been made. You will help define how JUMPSEC conducts Continuous Recon, how we validate external exposure, how we run external hunts, how we scale vulnerability research, and how we turn attacker-visible signals into client security outcomes.

For the right person, this role offers the chance to grow from recon operator into a true external exposure specialist: someone who can investigate, validate, engineer, research, and influence how organisations reduce risk before attackers exploit it.

How to apply

If you are interested in applying for this role, please provide a short cover letter outlining your experience and why you would be a good fit for JUMPSEC to [email protected]. Please reference JSReconEng in the subject line.

For more information on who we are and what we do, please visit www.jumpsec.com.

Whilst we do our utmost to reply to each candidate, we are sometimes inundated with applications, and this can lead to slight delays in replies. If you do not hear back from us within 20 working days, please consider yourself unsuccessful and we thank you for your time and effort in applying for this role.

At JUMPSEC, we believe that great people drive our success, and we embrace diversity and inclusion as integral parts of our company culture. We welcome individuals from all backgrounds, ethnicities, cultures, and genders. Diverse perspectives and ideas contribute to the uniqueness of our brand and enable the creative problem-solving that our clients value. Join us on our mission to create a safer digital world!

Achieve the cybersecurity outcomes you need.

We work to enable effective cybersecurity for our clients; helping them to future proof their cyber defences and realise genuine improvement over time.

Get started
×

Under attack? Call our 24/7 Incident Response Hotline now

Get in touch with an accredited Incident Response experts who can help you contain, recover and mitigate attacks.

0333 987 4048

For regular switchboard please
contact - 0333 939 8080