Profectus is seeking multiple experienced Lead Penetration Testers to lead penetration testing and simulated attack exercises within an Australian Government agency. You will test enterprise web applications, mobile platforms and infrastructure, and lead a team of testers through scoping, testing and reporting. The work covers web and mobile application testing, infrastructure testing, threat simulation and forensic support.
Key Responsibilities
Lead penetration tests and vulnerability assessments across web, mobile and infrastructure targets
Perform web application and mobile penetration testing against complex enterprise platforms
Conduct infrastructure penetration testing against enterprise grade systems
Plan and run threat simulation and simulated attack exercises to test technical security controls
Review and approve security testing plans and test cases
Work with system owners to agree test scope, prepare for testing and confirm remediation has been completed
Maintain the catalogue of test findings and recommended remediation measures
Write and review reports and briefs, and present technical findings to system owners and stakeholders
Research and improve testing tools, techniques and procedures
Undertake first responder forensic tasks, including data recovery, preservation and analysis
Coach and mentor testers through on-the-job training
Set team priorities and manage workflows, resources and performance
Required Experience
Leading complex penetration tests without close supervision, or leading teams that deliver them (CIISEC Level 5)




Running simulated attack exercises and exploitation activities
Web application and mobile application penetration testing on enterprise platforms
Infrastructure and network penetration testing on enterprise grade systems
Hands-on use of commercial and bespoke testing tools, such as Burp Suite, Metasploit, Nmap, Nessus and Kali Linux
First responder forensic tasks, and using specialist tools to recover, preserve and analyse data (CIISEC Level 4)
Writing transparent technical reports with prioritised remediation recommendations
Leading and coaching a technical team
CREST Certified Tester (Infrastructure or Web Applications) or CHECK Team Leader
CREST Registered Penetration Tester
Offensive Security Certified Expert 3 (OSCE3) or GIAC Penetration Tester (GPEN)
CompTIA PenTest+, CompTIA Security+ or Certified Ethical Hacker (CEH)
Penetration testing within Australian Government or other large enterprise environments
Security Clearance Requirements
Must be an Australian Citizen
Must have a current AGSVA Security Clearance
Must be willing to obtain an AGSVA Negative Vetting Level 1 (NV1) Security Clearance
Working Arrangements
Hybrid
Must be onsite for the first 6 weeks
Canberra, Brisbane, Melbourne or Adelaide
Why Profectus
Profectus partners with Australian Government agencies to deliver trusted ICT capability across complex delivery programs. We take a long term, relationship driven approach, supporting our people across the full lifecycle of their engagement while contributing to outcomes of national importance.
#J-*****-Ljbffr

📌 Penetration Tester (Canberra)
🏢 Profectus
📍 Canberra