The brutally honest version firstWe are hiring a mid-level penetration tester who wants more responsibility than running tools and producing standard reports.

This is a hands-on consulting role. You will deliver penetration tests across web applications, APIs, infrastructure, cloud and identity, and support security configuration reviews across AWS, Microsoft Azure and Microsoft 365. You will own your engagements from scoping through to presenting findings and confirming the fixes actually worked.

We are not hiring a practice leader, and we are not hiring someone who has moved away from technical delivery. We need someone with credible offensive security experience who works independently, explains their reasoning and becomes the person the rest of the team checks with.

Exposure to large language models, chatbots or other AI-enabled systems is highly desirable. We do not expect an AI security specialist. We do expect curiosity about how AI changes application behaviour, trust boundaries and attack surfaces.

What you will actually doThis is a delivery role first, with responsibility across the whole engagement rather than one slice of it.

Core delivery, where most of your time goes:

- Plan and execute penetration tests of web applications, APIs, infrastructure, cloud and identity platforms within an agreed scope
- Design realistic attack scenarios instead of working through a checklist, and chain weaknesses across systems where that reflects a credible threat
- Test authentication, authorisation, session management and application logic by hand, and validate every finding before it goes near a report
- Validate defensive controls such as web application firewalls, rate limiting, multifactor authentication and bot protection
- Support security configuration reviews across AWS, Microsoft Azure and Microsoft 365: identity, privileged access, exposed services, logging and control settings
- Write evidence-based reports that explain the technical finding and the business impact, then present them to engineers, CIOs and CISOs
- Retest and confirm whether a fix actually closed the issue

Beyond the test itself:
- Help scope engagements and shape the testing approach before a proposal goes out
- Contribute to methodology, tooling and report quality
- Share what you know with the wider team, including the placement students who work alongside us

You will own your work and recognise when an issue needs escalation, peer review or specialist input. AI-enabled systemsAI exposure is not mandatory, but it will matter more every year as we assess chatbots, copilots, LLM-enabled applications and agent-based architectures for Australian clients.





Any of the following will strengthen your application:

- Testing or building LLM-enabled applications, chatbots or copilots
- Prompt injection, instruction manipulation and policy bypass
- Sensitive data exposure through model responses, context or connected data sources
- AI agents that call APIs, tools or business processes, and how they handle permissions, state and memory
- Familiarity with the OWASP Top 10 for LLM Applications

We value practical exposure and an evidence-led approach over claimed expertise in a field that is still being defined. As you develop, you will help us refine how AI security assessments are scoped, executed and reported. What we need from youStrong penetration testing capability is essential. Everything else below is an advantage, and nobody will have all of it.

Technical capability across several of the following:

- Web application and API penetration testing, including modern architectures such as microservices, cloud-hosted systems and mobile backends
- Infrastructure and network penetration testing
- Authentication, authorisation and identity testing, including Active Directory and Microsoft Entra ID
- AWS, Microsoft Azure or Microsoft 365 security, and cloud or SaaS configuration reviews
- Scripting or automation in Python, PowerShell or Bash
- Attack-path analysis, adversary simulation or red-team-style testing
- Fluency with the usual tooling: Burp Suite, Nmap, Metasploit, BloodHound and whatever else the job needs

How you work matters as much as what you know:
- You look for credible attack paths rather than treating each vulnerability in isolation
- You separate real risk from scanner noise, and technical severity from business impact
- You document evidence so another consultant can reproduce your result
- You distinguish verified findings from informed analysis, and say so when you are unsure
- You take ownership of the engagement and ask for help before uncertainty affects delivery quality
- You explain the same finding clearly to an engineer and to an executive who will never open the technical appendix

Certifications and backgroundPractical capability carries more weight than credentials, but the right certifications are useful evidence of technical commitment.



OSCP is highly desirable. OSWA, OSWE, OSEP, CRTO, CREST CRT or an equivalent practical credential will also count in your favour.

You should also have

- Commercial experience delivering penetration testing engagements for clients or internal stakeholders
- Strong written and verbal communication, including explicit, evidence-based reports you wrote yourself
- A cybersecurity, computer science or related qualification, or equivalent capability demonstrated through practical work, certifications or independent research

About CliffsideCliffside Cybersecurity is a Sydney consultancy whose tagline is brutally honest cybersecurity. That is not about being harsh. It is about telling clients what they need to hear, including when it costs us revenue. We started in 2014 as a security architecture practice, which is why we look at how systems fit together rather than fixating on one technology. Today we deliver penetration testing, security architecture, GRC, ISO 27001 programmes, Essential Eight advisory and managed services to mid-market and enterprise Australian organisations, including energy, financial services, government and critical infrastructure. We are ISO/IEC 27001:2022 certified and a Microsoft Solutions Partner.

Our clients expect technically defensible findings, clear evidence and practical recommendations. They do not pay for scanner output with a logo on the cover.

Training the next generation is part of how we operate. We run formal placement partnerships with Australian universities and education providers, and a free mentoring programme, so you will work alongside students as well as senior consultants and be expected to help both get better.

Why this roleAt a larger consultancy you can spend years delivering one slice of a predefined methodology. Here you see the whole engagement: understanding the environment, defining the approach, testing, presenting to the people who make decisions, and supporting remediation.

You will

- Work directly with the founder and senior consultants, not through three layers of management
- Present your own findings to CIOs and CISOs rather than handing them to someone else
- Move between traditional testing and AI-enabled systems as that practice grows
- Shape how our offensive security services evolve, because the team is small enough that your input lands

This is not a role for someone who wants to run tools, export results and move to the next engagement. It is for someone who takes accuracy seriously, wants broader exposure and is ready to become a trusted technical contributor within a growing consultancy.

📌 Offensive Security Specialist (Sydney)
🏢 Cliffside Cybersecurity
📍 Sydney