I would strongly suggest Computer Science. With pen testing and cyber security you’ll use that knowledge of computing theory, programming, environments, algorithms, data security and transfer, etc. Computer Engineering tends to be more around the design and development of hardware and firmware (some still consider it a subset of Electrical Engineering)So to go back to your original question Maths, Further Maths, Computer Science, Physics would be the typical subjects for this but you could get away with dropping the physics for something else to show some breadth. Psychology which someone suggested would be a good one because if you’re into the security side of things, having that insight into human behaviour would be helpful.Can you do an EPQ? I could see you doing some really interesting work bringing together the psychology of cyber criminals and the work of those trying to combat it.