Cyber and GRC Solutions is looking for an experienced, CREST-certified penetration tester in Melbourne to deliver security testing engagements for our clients. You'll do in office and hands-on testing, working alongside our testing team and client IT staff.
What you'll do
External network and infrastructure testing – internet-facing hosts, VPN and remote-access gateways, reverse proxies, mail and port scanning
Web application testing – websites, portals and APIs
Wireless testing – enterprise (802.1X/EAP-TLS), guest/captive-portal and IoT networks, client isolation and point-to-point links
Internal network testing – assumed-breach testing, Active Directory and credential attacks, privilege escalation, lateral movement and segmentation review
Reporting – risk-rated findings with remediation steps and MITRE ATT&CK-aligned; EDR/SIEM recommendations
Retesting remediated vulnerabilities
Coordinating with client IT and SOC teams so authorised testing is recognised
About you
CREST certification (CRT minimum; CCT INF / CCT APP highly regarded) – mandatory
Proven hands-on experience across network/infrastructure, web application, wireless and internal penetration testing
Transparent, concise technical writing for both technical and audit audiences
Comfortable working to agreed rules of engagement in live production environments
Australian working rights and based in Melbourne
Nice to have
OSCP / OSEP / OSWE or similar offensive security certifications
Purple-team experience improving EDR/SIEM detections