More than 45 years ago, John C. Bogle a visionary to start an investment company that did things differently.
A company with no external shareholders.
Where all the profits were invested back into the business and used to lower costs.
Evidently, it was as bold as it was brilliant.
To this day, Vanguard Group still has no external shareholders.
That means no share prices to protect, and no profits to generate for outside owners.
Today, Vanguard is one of the world's largest investment management companies, serving more than 50 million investors worldwide.
For more than 30 years Vanguard Australia has been supporting individual investors, financial advisers, and superannuation members to achieve their long-term financial goals.
What You'll Do
The Offensive Security Analystis an individual contributor on the Offensive Security & Fraud Testing (OSFT) team.
This role focuses on hands-on Red Teaming and adversary simulation using traditional tools and techniques.
Role Overview
We are seeking a talented Offensive Security Analystto join our team of ethical hackers.
In this mid-level role, you will be an integral part of our red teaming and penetration testing efforts, using your technical expertise to find and exploit vulnerabilitiesacross web applications, networks, cloud platforms, and critical systems.
By thinking like an attacker, you will help us identify weaknesses before real adversaries do, and work with cross-functional partners to fix them.
This is a hands-on role focused on traditional offensive security methods – you'll use well-known and custom tools to emulate sophisticated threat actors, improve our security posture, and reduce risk.
Key Responsibilities:
Red Team Operations & Adversary Simulation:Participate infull-scope red team engagements, contributing across the kill-chain (reconnaissance, exploitation, lateral movement, data exfiltration, etc.).
Occasionallylead targeted adversary simulationsat moderate scope (e.g., a spear-phishing campaign or an endpoint compromise scenario, using phishing or malware implants).




Emulatereal threat actor TTPsaligned with frameworks like MITRE ATT&CK; to test our detection and response capabilities.
Collaborative Remediation & Purple Team Support:Work closely withdefensive teams– such as developers, system engineers, and security operations – to ensure discovered issues areunderstood and remediatedeffectively.
Provide actionable technical guidance to fix vulnerabilities (e.g., code remediation suggestions for development teams).
Supportpurple team exercisesby sharing attacker perspective knowledge and helping defensive teams validate alerts and improve detection rules.
Document each engagement thoroughly, producingclear and detailed penetration test reportsthat explain findings, their severity, and recommended mitigations.
Continuously research emerging vulnerabilities,new exploit techniques, and security trends in the offensive domain.
3–5+ years of hands-onpenetration testing and/or red teamingexperience.
Proven track record ofidentifying and exploiting vulnerabilitiesacross web applications (deep knowledge ofOWASP Top 10), networks, and cloud services.
Familiarity withshell scripting and programming (Python, PowerShell, Bash)for exploit development and automation.
Strong understanding of network protocols, operating systems, identity management, and security architecture.
Demonstrated ability tothink like an attackerto anticipate and craft creative exploitation scenarios.
Familiarity with frameworks and methodologies likeMITRE ATT&CK;, PTES (Penetration Testing Execution Standard), and relevant compliance standards (NIST, ISO), ensuring tests are realistic and comprehensive.
Strong written and verbal communication skills to produce high-quality reports and articulate risk to stakeholders.
Preferred Qualifications:
Offensive security certifications such asOSCP, OSWE, OSWA, GPEN, GWAPT,



or similar, demonstrating validated skills in penetration testing.
Experience performingthreat modelingand incorporating attacker perspective into security design reviews.
Familiarity withcloud platforms(AWS, Azure, GCP) and their specific security considerations.
Knowledge of secure software development practices and experience working withDevSecOpsor CI/CD pipeline security.
Red team operations exposureor small-scale adversary simulations (beyond standard pentesting), showing the ability to plan multi-phase attacks and operate stealthily.
Active participation in the security community (e.g., CTFs, bug bounties, open-source contributions) demonstrating passion for offensive security.
Inclusion Statement
Vanguard's continued commitment to diversity and inclusion is firmly rooted in our culture.
Every decision we make to best serve our clients, crew (internally employees are referred to as crew), and communities is guided by one simple statement: "Do the right thing."
We believe that a critical aspect of doing the right thing requires building diverse, inclusive, and highly effective teams of individuals who are as unique as the clients they serve.
We empower our crew to contribute their distinct strengths to achieving Vanguard's core purpose through our values.
When all crew members feel valued and included, our ability to collaborate and innovate is amplified, and we are united in delivering on Vanguard's core purpose.
Our core purpose: To take a stand for all investors, to treat them fairly, and to give them the best chance for investment success.
Special Factors
Vanguard is not offering visa sponsorship for this position
How We Work
Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection.
We believe our mission-driven and highly team-oriented culture is a critical enabler to support long-term client outcomes and enrich the employee experience.
#J-*****-Ljbffr

📌 Offensive Security Specialist (Melbourne)
🏢 Vanguard Group
📍 Melbourne