About This Role
Leading penetration testing and simulated attack exercises within an Australian Government agency is the core of this role. You will test enterprise web applications, mobile platforms, and infrastructure, and lead a team of testers through scoping, testing, and reporting.
Responsibilities
- Lead penetration tests and vulnerability assessments across web, mobile, and infrastructure targets
- Perform web application and mobile penetration testing against complex enterprise platforms
- Conduct infrastructure penetration testing against enterprise-grade systems
- Plan and run threat simulation and simulated attack exercises to test technical security controls
- Review and approve security testing plans and test cases
- Work with system owners to agree on test scope, prepare for testing, and confirm remediation has been completed
- Maintain the catalogue of test findings and recommended remediation measures
- Write and review reports and briefs, and present technical findings to system owners and stakeholders
- Research and improve testing tools, techniques, and procedures
- Undertake first responder forensic tasks, including data recovery, preservation, and analysis
- Coach and mentor testers through on-the-job training
- Set team priorities and manage workflows, resources, and performance
Requirements
- Leading complex penetration tests without close supervision, or leading teams that deliver them (CIISEC Level 5)
- Running simulated attack exercises and exploitation activities
- Web application and mobile application penetration testing on enterprise platforms
- Infrastructure and network penetration testing on enterprise-grade systems
- Hands-on use of commercial and bespoke testing tools, such as Burp Suite, Metasploit, Nmap, Nessus, and Kali Linux
- First responder forensic tasks, and using specialist tools to recover, preserve, and analyse data (CIISEC Level 4)
- Writing clear technical reports with prioritised remediation recommendations
- Leading and coaching a technical team
Nice to have:
- CREST Certified Tester (Infrastructure or Web Applications) or CHECK Team Leader
- CREST Registered Penetration Tester
- Offensive Security Certified Expert 3 (OSCE3) or GIAC Penetration Tester (GPEN)
- CompTIA PenTest+, CompTIA Security+, or Certified Ethical Hacker (CEH)
- Penetration testing within Australian Government or other large enterprise environments
Benefits
- Support across the full lifecycle of engagement
- Contribution to outcomes of national importance
