Penetration Tester

About This Role

Leading penetration testing and simulated attack exercises within an Australian Government agency is the core of this role. You will test enterprise web applications, mobile platforms, and infrastructure, and lead a team of testers through scoping, testing, and reporting.

Responsibilities

• Lead penetration tests and vulnerability assessments across web, mobile, and infrastructure targets
• Perform web application and mobile penetration testing against complex enterprise platforms
• Conduct infrastructure penetration testing against enterprise-grade systems
• Plan and run threat simulation and simulated attack exercises to test technical security controls
• Review and approve security testing plans and test cases
• Work with system owners to agree on test scope, prepare for testing, and confirm remediation has been completed
• Maintain the catalogue of test findings and recommended remediation measures
• Write and review reports and briefs, and present technical findings to system owners and stakeholders
• Research and improve testing tools, techniques, and procedures
• Undertake first responder forensic tasks, including data recovery, preservation, and analysis
• Coach and mentor testers through on-the-job training
• Set team priorities and manage workflows, resources, and performance

Requirements

• Leading complex penetration tests without close supervision, or leading teams that deliver them (CIISEC Level 5)
• Running simulated attack exercises and exploitation activities
• Web application and mobile application penetration testing on enterprise platforms
• Infrastructure and network penetration testing on enterprise-grade systems
• Hands-on use of commercial and bespoke testing tools, such as Burp Suite, Metasploit, Nmap, Nessus, and Kali Linux
• First responder forensic tasks, and using specialist tools to recover, preserve, and analyse data (CIISEC Level 4)
• Writing clear technical reports with prioritised remediation recommendations
• Leading and coaching a technical team

Nice to have:

• CREST Certified Tester (Infrastructure or Web Applications) or CHECK Team Leader
• CREST Registered Penetration Tester
• Offensive Security Certified Expert 3 (OSCE3) or GIAC Penetration Tester (GPEN)
• CompTIA PenTest+, CompTIA Security+, or Certified Ethical Hacker (CEH)
• Penetration testing within Australian Government or other large enterprise environments

Benefits

• Support across the full lifecycle of engagement
• Contribution to outcomes of national importance

Important Details

• Work format: Hybrid, must be onsite for the first 6 weeks
• Locations: Canberra, Brisbane, Melbourne or Adelaide

Security Clearance Requirements

• Must be an Australian Citizen
• Must have a current AGSVA Security Clearance
• Must be willing to obtain an AGSVA Negative Vetting Level 1 (NV1) Security Clearance

About the Company

Profectus partners with Australian Government agencies to deliver trusted ICT capability across complex delivery programs. They take a long-term, relationship-driven approach.