Cyber and GRC Solutions is looking for an experienced, CREST-certified penetration tester in Melbourne to deliver security testing engagements for our clients. You'll do on-site and hands-on testing, working alongside our testing team and client IT staff.
What you'll do
- External network and infrastructure testing – internet-facing hosts, VPN and remote-access gateways, reverse proxies, mail and port scanning
- Web application testing – websites, portals and APIs
- Wireless testing – enterprise (802.1X/EAP-TLS), guest/captive-portal and IoT networks, client isolation and point-to-point links
- Internal network testing – assumed-breach testing, Active Directory and credential attacks, privilege escalation, lateral movement and segmentation review
- Reporting – risk-rated findings with remediation steps and MITRE ATT&CK-aligned; EDR/SIEM recommendations
- Retesting remediated vulnerabilities
- Coordinating with client IT and SOC teams so authorised testing is recognised
About you
- CREST certification (CRT minimum; CCT INF / CCT APP highly regarded) – mandatory
- Proven hands-on experience across network/infrastructure, web application, wireless and internal penetration testing
- Transparent, concise technical writing for both technical and audit audiences
- Comfortable working to agreed rules of engagement in live production environments
- Australian working rights and based in Melbourne
Nice to have
- OSCP / OSEP / OSWE or similar offensive security certifications
- Purple-team experience improving EDR/SIEM detections