We are hiring a mid-level penetration tester who wants more responsibility than running tools and producing standard reports.

This is a hands-on consulting role. You will deliver penetration tests across web applications, APIs, infrastructure, cloud and identity, and support security configuration reviews across AWS, Microsoft Azure and Microsoft 365. You will own your engagements from scoping through to presenting findings and confirming the fixes actually worked.

We are not hiring a practice leader, and we are not hiring someone who has moved away from technical delivery. We need someone with credible offensive security experience who works independently, explains their reasoning and becomes the person the rest of the team checks with.

Exposure to large language models, chatbots or other AI-enabled systems is highly desirable. We do not expect an AI security specialist. We do expect curiosity about how AI changes application behaviour, trust boundaries and attack surfaces.

What you will actually do

This is a delivery role first, with responsibility across the whole engagement rather than one slice of it.

Core delivery, where most of your time goes:

- Plan and execute penetration tests of web applications, APIs, infrastructure, cloud and identity platforms within an agreed scope
- Design realistic attack scenarios instead of working through a checklist, and chain weaknesses across systems where that reflects a credible threat
- Test authentication, authorisation, session management and application logic by hand, and validate every finding before it goes near a report
- Validate defensive controls such as web application firewalls, rate limiting, multifactor authentication and bot protection




- Support security configuration reviews across AWS, Microsoft Azure and Microsoft 365: identity, privileged access, exposed services, logging and control settings
- Write evidence-based reports that explain the technical finding and the business impact, then present them to engineers, CIOs and CISOs
- Retest and confirm whether a fix actually closed the issue

Beyond the test itself:

- Help scope engagements and shape the testing approach before a proposal goes out
- Contribute to methodology, tooling and report quality
- Share what you know with the wider team, including the placement students who work alongside us

You will own your work and recognise when an issue needs escalation, peer review or specialist input.

AI-enabled systems

AI exposure is not mandatory, but it will matter more every year as we assess chatbots, copilots, LLM-enabled applications and agent-based architectures for Australian clients.

Any of the following will strengthen your application:

- Testing or building LLM-enabled applications, chatbots or copilots
- Prompt injection, instruction manipulation and policy bypass
- Sensitive data exposure through model responses, context or connected data sources
- AI agents that call APIs, tools or business processes, and how they handle permissions, state and memory




- Familiarity with the OWASP Top 10 for LLM Applications

We value practical exposure and an evidence-led approach over claimed expertise in a field that is still being defined. As you develop, you will help us refine how AI security assessments are scoped, executed and reported.

What we need from you

Solid penetration testing capability is essential. Everything else below is an advantage, and nobody will have all of it.

Technical capability across several of the following:

- Web application and API penetration testing, including modern architectures such as microservices, cloud-hosted systems and mobile backends
- Infrastructure and network penetration testing
- Authentication, authorisation and identity testing, including Active Directory and Microsoft Entra ID
- AWS, Microsoft Azure or Microsoft 365 security, and cloud or SaaS configuration reviews
- Scripting or automation in Python, PowerShell or Bash
- Attack-path analysis, adversary simulation or red-team-style testing
- Fluency with the usual tooling: Burp Suite, Nmap, Metasploit, BloodHound and whatever else the job needs

How you work matters as much as what you know:

- You look for credible attack paths rather than treating each vulnerability in isolation
- You separate real risk from scanner noise, and technical severity from business impact
- You document evidence so another consultant can reproduce your result
- You distinguish verified findings from informed analysis, and say so when you are unsure
- You take ownership of the engagement and ask for help before uncertainty affects delivery quality
- You explain th

📌 Offensive Security Specialist (Sydney)
🏢 Cliffside Cybersecurity
📍 Sydney