Technical Account Manager - Knutsford

PortSwigger · Knutsford, United Kingdom · Full-time · Posted 2026-10-01

Workplace: on_site

Department: Sales Tribe

Description

Who are PortSwigger

PortSwigger exists to enable the world to secure the web. We build the tools practitioners trust, the knowledge that trains security professionals, and a community that makes anyone who cares about security better — so anyone can make the internet safer. Our products are crafted with care, backed by deep research, and we lead through generous innovation: winning by setting the bar higher and sharing what we create, turning commercial success into wider positive impact.

Our culture didn't happen by accident - it was built deliberately, and it's something we protect with the same care we put into everything we make. We default to trust - brilliant people doing brilliant work, free from micromanagement. We aim for excellence, and we do it with care; performance and compassion go hand in hand. Joy, mastery and purpose belong together here - and if the work stops feeling good, we take that seriously.

Growth is our commercial engine: bringing new customers on board, keeping them delighted, and telling our story to the market. Growth is split into Sales, Customer Experience (Relationship Management, Customer Success and Tech Support), Marketing and Special Ops - collectively owning pipeline, retention, advocacy and the go-to-market playbooks that scale PortSwigger.

What you'll be doing

A renewal conversation turns painful long before it shows up in a QBR. It usually starts months earlier - in a rollout that never quite launched, a feature nobody adopted, or a security team that quietly stopped logging in. By the time anyone's discussing it formally, the account team is negotiating from a position they should never have been in. This role exists to read those signals early enough to still change the outcome.

You'll own a portfolio of PortSwigger's most technically demanding enterprise accounts, watching usage data, support patterns and stalled deployments for the moment something needs a person, not a dashboard. Sometimes that's you - diagnosing a broken SAML integration or a CI/CD pipeline that's only half-wired to Burp. Sometimes it's knowing exactly when to pull in a Solutions Architect or another specialist, and staying accountable for the outcome either way.

No two weeks look quite the same, but you'll regularly find yourself:

Pulled into a rollout that's stalled for reasons nobody's pinned down yet - a SAML config that's subtly wrong, an API integration that's 90% finished, a scan that was never actually scheduled - and getting hands-on until it's fixed, or the customer's own engineers can fix it themselves.

Reading the account health data - usage, support tickets, renewal timing - to spot the account that's gone quiet before anyone else notices, and deciding what actually needs to happen next.

Explaining the same technical issue three different ways in the same week: to a developer who wants the detail, a security leader who wants the risk, and an executive who wants the plan.

Spotting a champion who's gone quiet inside an account, and working out fast whether that's a stalled project you can unblock yourself, or a signal Sales and Renewals need to hear about now rather than next quarter.

Turning a one-off save into something reusable - a playbook, a script, a written-up approach - so the next TAM who hits the same problem doesn't have to solve it from scratch.

Whatever the account, you'll get into the technical detail, own the outcome, and leave the next person's job a little easier than you found it. Most TAM roles ask you to pick a lane - technical or commercial, hands-on or strategic. This one is built so you don't have to: you'll carry real technical weight and real account accountability in the same job, with the judgement to know which one a given moment actually needs.

Requirements

You're credible in a room of engineers and just as credible in a room of leaders - and you know how to be both without performing either. Put a customer's architecture in front of you and you start asking the right questions: where the identity provider sits, what's actually going wrong in that API integration, why a scan never got scheduled. You don't need to own every fix yourself, but you're not intimidated by getting hands-on with one.

You're comfortable enough with code and scripting to build a small tool, read CI/CD script pipelines or work out where a deployment pipeline is quietly broken. Networks, identity, cloud infrastructure and how services actually talk to each other aren't a foreign language to you. PortSwigger's own products are entirely learnable on the job - the underlying fluency isn't.

You'd rather build the picture yourself from account data than wait to be told there's a problem - adoption trends, support patterns, renewal risk - and you use what you find to decide the next best action, not just to report on it. When a problem is genuinely ambiguous, you bring structure to it: establish the facts, set a plan, come back with a recommendation, and escalate early when the situation actually calls for someone else.

You're curious about AI without needing to prove it through a list of tools you've used. What matters is what the curiosity leads to - an onboarding you managed better, a churn signal you caught earlier, a process that got faster because you tried something new.

You're low-ego and direct. You'd rather hand a colleague the working playbook than the war story, and you're just as comfortable pairing with an engineer as briefing a security leader on the same issue in language that actually lands for them.

You've probably built your career in hands-on, customer-facing technical work - as a Technical Account Manager, Customer Success Engineer or Solutions Engineer; coming from application security or DevSecOps with real customer exposure; or as a software engineer or support engineer who ended up owning the relationship as much as the fix. The exact title matters less than whether you've lived at the point where deep technical work meets an enterprise relationship.

Realistically you're 4-8+ years into that kind of career - a guide, not a ceiling; plenty of strong candidates will have more. Environments that tend to prepare people well: enterprise security or developer-tooling SaaS, application security, complex web architectures, cloud and CI/CD, or integrations that touch APIs, identity and more than one stakeholder group.

You won't match every line of this exactly, and that's fine. If most of it sounds like you, we'd like to hear from you.

Benefits

At PortSwigger, we believe people should be paid what they're truly worth - not just what we could get away with or what the market dictates. That's why we pay above the market rate, and review it regularly.

In our 2025 survey, 80% of Swiggers said they were satisfied or very satisfied with their reward - against a YouGov benchmark of 40% for knowledge workers. The philosophy works.

Alongside a strong base salary, we offer share options and a comprehensive benefits package designed to support your whole-person wellbeing.

Want to know more? Explore our reward philosophy

Apply

Apply at PortSwigger

About the company

PortSwigger specializes in web application security testing. Its flagship product, Burp Suite, is a toolkit for discovering and testing web vulnerabilities used by researchers, small teams, and large organizations. Burp Suite is offered on a subscription basis with Professional and Enterprise editions, with additional revenue from training and support services. The goal is to help organizations find and fix vulnerabilities earlier in development, integrate security into CI/CD pipelines, and improve overall security posture.

Company Size

201-500

Company Stage

Growth Equity (Venture Capital)

Total Funding

$115.2M

Headquarters

Knutsford, United Kingdom

Founded

2003

Get referred to PortSwigger

See people who can refer or advise you

Simplify's Take

What believers are saying

Burp AT launched July 2026, adding agentic AI to Professional users.
PortSwigger's July 2026 HTTP Terminator research found Apache Traffic Server CVE-2026-63078.
2024 Brighton Park's $112 million investment funds product, research, and international expansion.

What critics are saying

Burp AT is public beta; competitors like Rapid7 and Invicti can ship faster.
Agentic AI introduces trust failures; one bad autonomous scan damages reputation immediately.
Burp Suite's web-app focus creates existential risk if API testing commoditizes.

What makes PortSwigger unique

Burp Suite remains the default web pentesting workstation, used by 90,000 professionals.
PortSwigger combines research, tooling, and training; Burp AT ships research-backed workflows.
SAP adopted Burp Suite DAST for Sovereign Cloud security, validating enterprise credibility.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Health Insurance
Life Insurance
Disability Insurance
Stock Options
Paid Holidays

Growth & Insights and Company News

Headcount

6 month growth

1 year growth

2 year growth

REAL HACKER NEWS

Aug 7th, 2026

AI-Assisted HTTP Terminator finds novel HTTP desync techniques and Apache zero-day.

AI-Assisted HTTP Terminator finds novel HTTP desync techniques and Apache zero-day. 2 2 minutes read Swati KhandelwalAug 07, 2026Web Security / Vulnerability PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. Kettle said HTTP Terminator tested 30,000 websites where scanning was authorized through bug bounty or vulnerability disclosure programs and found roughly 700 vulnerable targets before deeper validation and RQP research. Kettle said those findings involved banks, government infrastructure, security products, and an airport. The research produced new desync triggers, a dual-matching Content-Length pattern, and a "dangling-byte" technique designed to make response queue poisoning (RQP) more reliable. RQP can potentially make a front end lose track of which back-end response belongs to which user, potentially exposing another user's response, including session cookies or API keys. The researchers also disclosed Shared-Parser Confusion, a broader attack concept that the system proposed but Kettle validated. The defense has not changed: PortSwigger recommends avoiding HTTP/1.1 upstream. Where HTTP/1.1 cannot be removed, it recommends allow-listing methods at both layers and restricting which methods may carry request bodies. In the technical write-up, Kettle said he fed HTTP Terminator 138 HTTP and SMTP RFCs. Those RFCs were split into about 15,000 small fragments and used as inspiration to generate 30,000 unique candidate vectors. One Content-Type: multipart/byteranges technique worked across multiple server implementations and exposed more than 200 websites in the test set, including an unnamed U.S. bank. The autonomous research then tested 16 ideas for improving RQP. Only the dangling-byte technique survived evaluation. It leaves a smuggled request one byte short so the second back-end response is not produced until a victim request supplies the missing byte, eliminating a race condition that otherwise makes RQP unreliable on many sites. In the human-guided cascade, a malformed request eventually exposed the desynchronization zero-day in Apache Traffic Server. The researchers said the issue has since been patched and tracked as CVE-2026-63078. An August 7 check by The Hacker News did not find a public record for CVE-2026-63078 in CVE.org or NVD, and Apache's July advisory covering 34 flaws did not list it. That leaves a verification gap around the Apache case: the cited public records do not yet let defenders map CVE-2026-63078 to a specific fixed Traffic Server release. Kettle said Shared-Parser Confusion emerged when HTTP Terminator noticed that response-processing rules could be misapplied to requests when servers reuse parsing logic. The system proposed the concept, but Kettle, director of research at PortSwigger, validated and generalized it. "Neither of us would have discovered it alone," he said. That distinction defines the autonomy boundary in this research: the system generated and proved several techniques without direct human discovery input, while the Apache zero-day and Shared-Parser Confusion still required Kettle's intervention. PortSwigger has open-sourced HTTP Terminator. The paper does not identify which exact model or version generated each autonomous discovery. The released implementation uses Claude for document extraction and test-case generation, while its investigator stage requires Claude Code. Separately, researchers behind CRLF-powered desync attacks released public tools for studying that attack class, including crlf-desyncs and crlf-powered-desync-scanner. Kettle separately tested newer models on a rediscovery benchmark and reported a 30% success rate for GPT-5.6 Sol when given an inspiration technique.

PR Newswire

Jul 29th, 2026

PortSwigger launches Burp AT: agentic AI for professional pentesting in Burp Suite

PortSwigger has launched the public beta of Burp AT, bringing agentic AI to professional penetration testing in Burp Suite. The tool allows pentesters to assign investigative tasks to AI agents whilst maintaining control through enforced scope and approval rules. Burp AT enables agents to use Burp Suite's specialist web security tools and draw on engagement context from projects. The product includes purpose-built pentesting skills developed with PortSwigger Research, giving agents structured testing approaches without custom prompts. Scope and approval rules are enforced in Burp's tooling layer, separate from the AI model. Agents can propose actions but cannot execute anything Burp does not permit. All agent activity is recorded in the project for inspection. The public beta is available to Burp Suite Professional users.

HiTechNectar

Jul 29th, 2026

PortSwigger launches Burp AT: agentic AI for professional pentesting in Burp Suite.

PortSwigger launches Burp AT: agentic AI for professional pentesting in Burp Suite. KNUTSFORD, England, July 29, 2026 /PRNewswire/ - PortSwigger, makers of Burp Suite, today announced the public beta of Burp AT, a new product that brings agentic AI to professional pentesting in Burp Suite. Machine Learning & Artificial Intelligence Burp AT gives pentesters a new way to put agentic AI to work in Burp Suite. Agents can pursue defined investigative tasks using Burp Suite's tools, relevant context from the project and purpose-built pentesting skills. Pentesters decide how much work agents take on, while Burp enforces scope, permissions and approval rules. The pentester remains responsible for scope, judgment and conclusions. Models can now do more than run predefined checks. They can form hypotheses, act through tools, interpret how an application responds and decide what to try next. But using that capability professionally requires more than capable reasoning. Agents also need reliable execution, relevant engagement context, structured testing methodology and boundaries they cannot reinterpret or bypass. "AI can already find vulnerabilities. The harder question is whether you can trust it against a real target. Burp AT gives the model room to reason, but Burp controls what it can actually do, executes the work through tools pentesters already rely on, and preserves the evidence. That is what turns agentic testing from an impressive demonstration into something useful on a real engagement," said Dafydd Stuttard, Burp Suite creator and CEO of PortSwigger. For pentesters already experimenting with coding agents and improvised agentic workflows, Burp AT provides a specialist alternative to assembling and maintaining integrations, prompts, context and controls around the testing workflow. Built on Burp Suite What agents can achieve depends heavily on the tools and context they work with. Burp AT enables agents to work natively through Burp Suite's specialist web security tools, rather than relying on general-purpose HTTP libraries or improvised integrations. Business Operations Burp Suite's tools reflect more than two decades of use against real applications. They reliably handle the malformed requests, message manipulation and protocol edge cases that professional web security testing often demands, allowing models to focus their effort on what to investigate and what to try next. Agents can also draw selectively on relevant information already held in the Burp project, including traffic, target structure, issues and discoveries gathered throughout the engagement. They can add to that shared context as they work, enabling later investigations to continue from what is already known rather than beginning again from a blank prompt. Purpose-built pentesting skills Burp AT includes structured, task-specific pentesting skills developed with PortSwigger Research. These give agents reusable testing approaches without requiring every user to construct and maintain the methodology through prompts, scripts and workflow instructions. The skills also create a route from research to repeatable testing. As PortSwigger Research develops and validates new techniques, those approaches can be translated into skills that agents can apply during real tests. Discover more Autonomy on the pentester's terms Burp AT allows pentesters to choose how much work agents take on for each task and engagement. Actions can be allowed to proceed, configured to require approval or blocked. Smart approvals allow routine work to continue while escalating decisions that need the pentester's attention. Users can begin with tighter supervision and increase autonomy where agent performance, target sensitivity and engagement rules justify it. The existing Burp tools remain available whenever the pentester wants to take over directly. Boundaries enforced by Burp Scope, tool access and approval rules are enforced in Burp's tooling layer, architecturally separate from the model. They are not instructions that the model is expected to remember or choose to follow. Agents can propose actions, but cannot execute anything Burp does not permit. Agent requests and tool activity are recorded in the Burp project as testing progresses, giving pentesters a record they can inspect alongside the rest of the engagement rather than relying only on the model's own account. Available in public beta Burp AT is available now in public beta to Burp Suite Professional users. This first release puts Burp's agentic capabilities into the hands of professional pentesters on real engagements, where their feedback will shape how its tools, skills and workflows evolve. PortSwigger will expand the product throughout the beta while continuing to document its current capabilities and known limitations. To learn more about the current feature set, documentation and pricing, visit: https://portswigger.net/burp/burp-at About PortSwigger PortSwigger is on a mission to enable the world to secure the web. The company is behind Burp Suite, the industry-standard web security testing platform used by more than 90,000 security professionals and 18,000 organisations across 170+ countries. PortSwigger's products span practitioner-led testing and enterprise application security. Burp Suite Professional equips security professionals to investigate vulnerabilities in depth, while Burp Suite DAST helps more than 1,000 organisations automate security testing at scale. PortSwigger also works strategically with global enterprises including SAP, and combines its software with pioneering security research and free practical training to advance how the web is secured. SOURCE PortSwigger HiTechNectar send you the latest trends and best practice tips for online customer engagement: Receive Updates: HiTechNectar hate spams too, you can unsubscribe at any time.

Cryptika

Jul 28th, 2026

PortSwigger launches Burp AT agentic AI for human-led web Penetration Testing.

PortSwigger launches Burp AT agentic AI for human-led web Penetration Testing. Spread the love July 28, 2026 PortSwigger has officially launched Burp AT in public beta, bringing agentic AI capabilities directly into Burp Suite Professional for the first time. The new feature allows penetration testers to delegate specific investigative tasks to AI agents while retaining full control over scope, judgment, and final conclusions, marking a significant shift in how professional web application security testing is conducted. The launch addresses a growing question in the security community: not whether AI can find and exploit vulnerabilities, since frontier models already demonstrate that capability, but whether such AI can be trusted for professional testing work where accountability and reliability matter. PortSwigger's answer is a system that combines Burp Suite's two-decade-old toolset with project-specific context and specialist pentesting skills developed alongside PortSwigger Research. PortSwigger launches Burp AT. Burp AT operates on four core pillars designed to make agentic testing viable in real engagements. First, agents work through Burp's established tooling rather than starting from scratch, drawing on existing project data like captured traffic, target structure, and prior findings. Second, a growing library of purpose-built pentesting skills gives agents structured methodologies instead of relying on general model knowledge, with new techniques added as PortSwigger's researchers develop them. Third, testers control autonomy levels, deciding what agents can execute independently, what requires approval, and what stays off-limits entirely. Fourth, and critically, all boundaries are enforced by Burp's tooling layer rather than the AI model itself, meaning every action is logged, and agents cannot bypass restrictions even if they propose them. This architecture reflects PortSwigger's core philosophy for the release: agents propose actions, Burp enforces limits, and the human tester decides. During closed beta testing, the practical impact became clear. One pentester used Burp AT to analyze 66,000 lines of minified JavaScript within a four-day engagement, a task impossible to complete manually in that timeframe. The agent reconstructed endpoints and workflows from the obfuscated code and flagged suspicious, unauthenticated areas for deeper investigation. This process surfaced a critical vulnerability that would likely have remained undetected for at least another year. The tester described the experience as transformative for both testing efficiency and skill development. Because all agent activity runs through Burp Suite itself, testers retain reproducible evidence, including requests and responses, rather than having to trust an AI's self-reported summary of its actions. This initial release represents what PortSwigger calls the first phase of a longer roadmap. Currently, Burp AT functions within a human-led workflow, augmenting individual testers' capacity rather than replacing their oversight. PortSwigger has indicated that future iterations will introduce additional operating modes suited to teams and enterprises, potentially including more autonomous testing under standing policies with shared visibility and audit trails, while human-led testing remains a permanent option. Speaking on the launch, PortSwigger Founder and CEO Dafydd Stuttard emphasized that trust must be earned rather than assumed. He noted that while Burp Suite has built credibility over more than 20 years of real-world use, Burp AT is new and must prove itself through the same process, which is why the company chose a public beta rather than a full release, inviting testers to stress-test the tool and shape its development. Burp AT is available now for all Burp Suite Professional users, offering a practical entry point for security professionals looking to integrate agentic AI into their existing testing workflows without ceding control over sensitive engagements. Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. Portswigger has released its latest version of Burp Suite 2023.9.1, which includes a lot of additional features and bug fixes that can be helpful for security professionals and web application penetration testers. Burp Suite has been one of the most used Penetration Testing tools used by security professionals and organizations... August 12, 2023 In "Cybersecurity News - Original News Source is cybersecuritynews.com" Burp Suite 2023.10.3.4 was just published by PortSwigger and is aimed at ethical hackers and security experts with updated features. Burp Suite is a cybersecurity tool used for web application security testing. It is an intercepting proxy, allowing users to examine and manipulate the traffic between a web browser and... November 11, 2023 In "Cybersecurity News - Original News Source is cybersecuritynews.com" A new AI tool named HexStrike AI has been launched, designed to bridge the gap between large language models (LLMs) and practical cybersecurity operations. The latest release, v6.0, equips AI agents like OpenAI's GPT, Anthropic's Claude, and GitHub's Copilot with a formidable arsenal of over 150 professional security tools, enabling... August 15, 2025 In "Cybersecurity News - Original News Source is cybersecuritynews.com"

PortSwigger

Jul 8th, 2025

PortSwigger at Black Hat & DEF CON 33

PortSwigger at Black Hat & DEF CON 33.

PortSwigger

Technical Account Manager

About the job