Penetration Tester

Orro Group; City of Brisbane; Hybrid; AUD 100,000 - 150,000; Full time

Job summary

Orro Group in Brisbane is seeking a security-minded tester who thinks like an attacker rather than following a checklist. You will dive deep into web apps, internal networks, and Active Directory environments to map them, find gaps, exploit them, and translate your findings into clear recommendations for clients.

The role blends independent, heads-down work with client-facing communication. You’ll explain your methods and results, and you’ll participate in on-site client visits as needed while

Qualifications

• Experience in security testing across web apps and networks.
• Ability to map systems and identify exploitable gaps.
• Strong technical curiosity and problem-solving abilities.

Responsibilities

• Test web apps, internal networks, and Active Directory environments.
• Map systems, identify gaps, exploit them, and translate findings for clients.
• Explain how and why findings matter in clear, actionable terms.
• Work flexibly in hybrid on-site and remote client engagements.

Skills

Web app testing

Network testing

Active Directory

Client-facing communication

Tools

CTF experience

Labs experience

Job description

Break things. Understand them. Make them safer.

If you've ever looked at a system and thought "there's a way into this" and then kept going until you proved it, this will feel familiar. If you've never really seen yourself in a corporate environment, that's fine. Most people here didn't either.

What You'll Do

This role is about thinking like an attacker. Not following a checklist. You'll spend most of your time deep in systems; testing web apps, internal networks, and Active Directory environments. Mapping things out, finding gaps, exploiting them, and understanding how far you can go. Then turning that into something clear and useful for the client.

Some days are quiet and focused. Other days you're explaining how you got domain admin and what needs to change.

The Team

There's no single path into this team. Some are self-taught. Some came from infrastructure or development. Some from consulting. Others learned through CTFs, labs, or just breaking things at home. If you've learned by doing, you'll fit right in.

Most of the work is independent and heads down. You'll have the space to go deep without being micromanaged. Being part of the team doesn't mean constant meetings or being "on" all day. It's about sharing ideas when you're stuck, getting a second set of eyes on something important, and working together when it actually adds value.

About You

You don't need to be extroverted to do well here. We care far more about how you think and what you produce than how you come across.

What matters is how you approach problems. You're curious, you like figuring things out without being told exactly how, and you're willing to go deep to get to an answer. You don't just follow a process — you look for what others miss.

At the same time, this is a client-facing role. Being able to clearly explain what you've found and why it matters is important.

How You'll Work

We encourage a hybrid way of working that allows us to perform testing remotely while also performing on-site visits to our clients where necessary to meet their needs.

You'll get exposure across web and application testing, internal networks, Active Directory, and more advanced attack simulation. This is real client work (not just controlled labs) and you'll have the freedom to contribute to how the work is done.

About Orro

We work across cloud, cyber, networks, and collaboration supporting some of Australia's most recognised organisations. Our cyber team focuses on practical, real-world security. No box-ticking.