Indigitise is seeking an experienced Penetration Testing Specialist to support the National Health and Medical Research Council (NHMRC) in conducting a targeted penetration testing exercise across its external infrastructure, cloud environment, network and Wi-Fi.
The engagement will assess the effectiveness of existing cyber controls, identify vulnerabilities and test the organisation’s resilience against realistic external attack scenarios.
Key responsibilities:
Identify and map the external attack surface.
Conduct external infrastructure and asset discovery.
Perform grey-box penetration testing.
Assess internet-facing firewalls and network infrastructure.
Test Azure cloud tenancies and Microsoft 365 exposure.
Assess Wi-Fi security from an adjacent attacker perspective onsite.
Test lateral movement scenarios.
Assess the potential compromise of a standard Azure Virtual Desktop session or Microsoft 365 credentials.
Identify vulnerabilities, attack paths and control weaknesses.
Provide explicit findings and remediation recommendations.
Technology environment: Azure, Microsoft 365, Zscaler, Aruba Central and Azure Virtual Desktop (VDI).
Out of scope:
Social engineering and third-party systems.
Essential Criteria
Candidates must demonstrate:
Robust experience delivering penetration testing and ethical hacking engagements.
Experience assessing external-facing infrastructure, firewalls and networks.
Solid Azure cloud security and penetration testing capability.
Experience assessing Microsoft 365 environments.
Experience conducting Wi-Fi and network penetration testing.
Ability to test lateral movement and credential compromise scenarios.
Experience with attack surface discovery and grey-box testing.
Ability to clearly document vulnerabilities, risks and remediation recommendations.
Availability to work onsite in the ACT during business hours.
Strong overall value for money and suitability for the engagement.
My recommendation: don’t advertise this as a generic “Penetration Tester.” Use “Senior Penetration Testing Specialist – Azure, M365 & Network”. That title will produce much better candidate matching in Zoho and Juicebox.