Nullify runs autonomous security work most teams can't staff for. This role is the human edge of that — validating what our agents find, going after what they can't, and feeding every technique back into the system so it gets sharper.

What You'll Do

- Run deep, manual web app pentests against customer surface area that automated scanning alone won't catch — auth flows, business logic, multi-step exploit chains.
- Turn novel findings into reproducible techniques that get encoded back into Nullify's detection and validation agents.
- Partner with customer security teams during engagements, from scoping through report-back.
- Keep pace with the frontier: new frameworks, new auth patterns, current classes of vulnerability.

What You Bring

- Real-world experience finding and exploiting vulnerabilities in production web applications — OWASP Top 10 and beyond.
- Comfort working close to the metal: reading application code, tracing requests, building custom tooling when off-the-shelf doesn't cut it.
- A bias toward proof over speculation — you validate before you report.
- Bonus: experience training or evaluating AI systems on security tasks.

#J-18808-Ljbffr

📌 Web Application Penetration Tester - Nullify (Sydney)
🏢 Black Nova Venture Capital
📍 Sydney