LRQA Nettitude

A UK cybersecurity testing and incident response provider, Nettitude Ltd trading as LRQA, assured by the National Cyber Security Centre.

About LRQA Nettitude

LRQA Nettitude is the cyber security arm of LRQA, a global company that helps organisations manage risk. Its experts act as ethical hackers: they test an organisation's computer systems the way a criminal would, to find weak points, and they help organisations respond when an attack really happens. Nettitude Ltd, trading as LRQA, is listed by the UK's National Cyber Security Centre (NCSC) for CHECK penetration testing, cyber incident exercising and cyber incident response.

Nettitude was founded in 2003 and was a cyber security provider with around 140 specialists when LRQA announced on 16 March 2018 that it was acquiring it. Founder and chief executive Rowland Johnson was quoted on the deal. Its pre-acquisition services included ISO 27001 and GDPR consulting, Cyber Essentials, PCI audit as a Qualified Security Assessor, CBEST assessments for financial services, penetration testing and vulnerability research. It is a UK-registered company with a Birmingham-area phone number on the NCSC page and a UK 24/7 incident response line. The pages we read do not give office addresses or UK headcount.

LRQA's careers page says its people share a mission "to make the world a safer place", and that it has colleagues in 50 countries working from food manufacturing to cybersecurity. We did not find a Nettitude-specific mission statement.

The services include CHECK penetration testing, which is an NCSC-approved scheme for testing government and sensitive systems, incident response, and incident exercising, which means practice drills for a cyber crisis. Earlier Nettitude services also covered compliance and managed security. LRQA also runs a CREST-accredited testing business: a news item says LRQA Nettitude was among the first to earn CREST's application security accreditation.

The clearest entry route we found is LRQA's Careers Accelerator Programme for people entering offensive cyber security. It says no professional penetration testing experience is required, and it is open to graduates, career changers and others. It is a full-time position that starts with months of bespoke training, including consultancy skills, web development basics, web application and infrastructure penetration testing, and protected time to work towards a certification such as OSCP. After that, trainees join real tests with senior testers. To apply you send a CV and cover letter and complete a Capture the Flag exercise, with a written explanation of how you solved at least two challenges. LRQA says it looks for aptitude and credible interest, such as a degree, blog, home lab or CTF play, though none is mandatory. The page gives no length, pay or office locations, and we do not know whether it is open now. Check LRQA's careers site.

What they do

• {'desc': 'NCSC-approved testing of IT systems.', 'title': 'CHECK penetration testing'}
• {'desc': 'Helping organisations deal with attacks.', 'title': 'Incident response'}
• {'desc': 'Practice drills for cyber incidents.', 'title': 'Incident exercising'}
• {'desc': 'Full-time training route into offensive security.', 'title': 'Careers Accelerator'}

Key facts

• Nettitude founded 2003; acquired by LRQA, announced 16 March 2018
• NCSC-assured for CHECK testing, incident exercising and incident response
• LRQA says it has colleagues in 50 countries; mission to make the world a safer place
• Careers Accelerator needs no prior pen-testing experience; includes time for OSCP

Website: www.lrqa.com/en-gb/cyber-security-services