Penetration Tester

Profectus; Canberra; Hybrid; AUD 150,000 - 190,000; Full time

Job summary

Profectus is seeking multiple experienced Lead Penetration Testers to lead penetration testing and simulated attack exercises within an Australian Government agency. You will test enterprise web applications, mobile platforms and infrastructure, and lead a team of testers through scoping, testing and reporting.

The role covers web and mobile application testing, infrastructure testing, threat simulation and forensic support, with hybrid working arrangements and initial on-site presence in

Qualifications

• Lead complex tests with minimal supervision and guide the team.
• Extensive web/mobile/infrastructure testing on enterprise targets.
• Experience with threat simulation and forensics support.
• Proficient in documenting and presenting findings to stakeholders.
• Hands-on use of industry-standard testing tools.

Responsibilities

• Lead penetration tests and vulnerability assessments across web, mobile and infrastructure targets
• Perform web application and mobile penetration testing against complex enterprise platforms
• Conduct infrastructure penetration testing against enterprise grade systems
• Plan and run threat simulation and simulated attack exercises to test technical security controls
• Review and approve security testing plans and test cases
• Work with system owners to agree test scope, prepare for testing and confirm remediation has been completed
• Maintain the catalogue of test findings and recommended remediation measures
• Write and review reports and briefs, and present technical findings to system owners and stakeholders
• Research and improve testing tools, techniques and procedures
• Undertake first responder forensic tasks, including data recovery, preservation and analysis
• Coach and mentor testers through on-the-job training
• Set team priorities and manage workflows, resources and performance

Skills

Team leadership

Penetration testing leadership

Test planning

Reporting & briefing

Mentoring testers

Education

CIISEC Level 5

CREST Team Leader

CREST Certified Tester

OSCE3 / GPEN

GIAC Penetration Tester

CHECK Team Leader

Tools

Burp Suite

Metasploit

Nmap

Nessus

Kali Linux

Job description

Profectus is seeking multiple experienced Lead Penetration Testers to lead penetration testing and simulated attack exercises within an Australian Government agency. You will test enterprise web applications, mobile platforms and infrastructure, and lead a team of testers through scoping, testing and reporting. The work covers web and mobile application testing, infrastructure testing, threat simulation and forensic support.

Key Responsibilities

• Lead penetration tests and vulnerability assessments across web, mobile and infrastructure targets
• Perform web application and mobile penetration testing against complex enterprise platforms
• Conduct infrastructure penetration testing against enterprise grade systems
• Plan and run threat simulation and simulated attack exercises to test technical security controls
• Review and approve security testing plans and test cases
• Work with system owners to agree test scope, prepare for testing and confirm remediation has been completed
• Maintain the catalogue of test findings and recommended remediation measures
• Write and review reports and briefs, and present technical findings to system owners and stakeholders
• Research and improve testing tools, techniques and procedures
• Undertake first responder forensic tasks, including data recovery, preservation and analysis
• Coach and mentor testers through on-the-job training
• Set team priorities and manage workflows, resources and performance

Required Experience

• Leading complex penetration tests without close supervision, or leading teams that deliver them (CIISEC Level 5)
• Running simulated attack exercises and exploitation activities
• Web application and mobile application penetration testing on enterprise platforms
• Infrastructure and network penetration testing on enterprise grade systems
• Hands-on use of commercial and bespoke testing tools, such as Burp Suite, Metasploit, Nmap, Nessus and Kali Linux
• First responder forensic tasks, and using specialist tools to recover, preserve and analyse data (CIISEC Level 4)
• Writing clear technical reports with prioritised remediation recommendations
• Leading and coaching a technical team
• CREST Certified Tester (Infrastructure or Web Applications) or CHECK Team Leader
• CREST Registered Penetration Tester
• Offensive Security Certified Expert 3 (OSCE3) or GIAC Penetration Tester (GPEN)
• CompTIA PenTest+, CompTIA Security+ or Certified Ethical Hacker (CEH)
• Penetration testing within Australian Government or other large enterprise environments

Security Clearance Requirements

• Must be an Australian Citizen
• Must have a current AGSVA Security Clearance
• Must be willing to obtain an AGSVA Negative Vetting Level 1 (NV1) Security Clearance

Working Arrangements

• Hybrid
• Must be onsite for the first 6 weeks
• Canberra, Brisbane, Melbourne or Adelaide

Why Profectus

Profectus partners with Australian Government agencies to deliver trusted ICT capability across complex delivery programs. We take a long term, relationship driven approach, supporting our people across the full lifecycle of their engagement while contributing to outcomes of national importance.