United Kingdom (Remote)1 open job
Cognisys provides CREST-accredited penetration testing, GRC consulting, vulnerability management and managed security services across networks, cloud, web, mobile, APIs and AI systems.
Cognisys sells the unglamorous half of security work: CREST-accredited penetration testing, vulnerability management, security operations, and governance, risk and compliance consulting. The threat model it addresses is broad by design - networks, web, mobile and API applications, cloud infrastructure and increasingly AI systems, assessed with automated tooling paired with manual exploitation techniques. CREST accreditation is the credential that matters here: it means the testing practice is externally validated rather than self-declared.
The GRC division is where the compliance sprawl gets handled. Cognisys consultants implement across more than ten frameworks - ISO 27001, ISO 42001, SOC 2, GDPR, NIST CSF, CMMC, Cyber Essentials, PCI DSS, DORA and NIS2 - covering both the classic certification path and the newer regulatory stack aimed at AI governance and operational resilience. The company is also Vanta's number-one global service partner, which puts automation-driven compliance work alongside the manual testing side.
Founded in Halifax in 2019 with a four-person team, Cognisys passed 100 employees in April 2026 and works with organisations in more than 30 countries across Europe, North America, Africa, Asia-Pacific and the Middle East. Delivery is split across ongoing managed security services and security operations alongside point-in-time assessment work. The stated mission is to turn security from a business blocker into a business enabler - a framing that, in practice, means pairing technical findings with practical guidance on sustainable compliance outcomes.
