Penetration Tester

cba; Hobart, Sydney; On-site; AUD 100,000 - 140,000; Full time

Job summary

CommBank is seeking a hands-on Penetration Tester to perform testing across cloud, networks, SaaS and AI-enabled technologies, strengthening security across the bank.

You will work within a collaborative security testing team, defining scope, reporting findings clearly, and guiding remediation efforts while continually learning in a fast-evolving landscape.

Qualifications

• Hands-on security testing capability and curiosity across diverse tech.
• Ability to adapt across technologies and learn as threats evolve.
• Experience across multiple testing domains is advantageous.

Responsibilities

• Deliver penetration testing across cloud, SaaS, infrastructure, networks, web applications and enterprise platforms.
• Help define the scope, approach and appropriate level of rigour for engagements.
• Identify and safely validate vulnerabilities, showing risk and business impact.
• Produce clear, practical reports to help tech teams understand findings and remediation.
• Collaborate with engineers, platform teams and other security chapters.
• Contribute to improvements in testing methods, tooling, automation and practices.
• Explore responsible uses of AI to support testing workflows.

Skills

Penetration testing

Vulnerability identification

Clear reporting

AI/Automation testing

Tools

Kali Linux

Burp Suite

Metasploit

AWS

Google Cloud Platform

Azure

Job description

Penetration Tester

Deliver hands-on penetration testing across cloud, platforms, networks, SaaS and emerging technologies.

Join an energetic and transparent team where curiosity, collaboration and knowledge-sharing are valued.

Explore how AI and automation can strengthen security testing and help protect the bank and its customers.

Bring your ambition and we'll help you grow, belong and shape what's next in cyber security.

Do work that matters

As a Penetration Tester, you'll deliver technical security testing that helps strengthen the bank's security and risk posture. You'll identify and validate vulnerabilities, demonstrate their potential impact and provide practical recommendations that support effective remediation.

The work is broad and often more complex than standard web application testing. You'll assess platforms and services spanning cloud, networks, infrastructure, SaaS, observability and logging, engineering tools and emerging AI-powered technologies.

You don't need to specialise in every area. We're looking for someone with solid penetration testing foundations, the adaptability to work across different technologies and the curiosity to keep learning as the threat and technology landscape evolves.

See yourself in our team

Group Security is part of Technology and brings together cyber security, protective security, business resilience, fraud technology and cyber defence capabilities. Its purpose is safeguarding a brighter future for all by securing the bank, protecting customers, building recovery capability and creating an admired place to work.

You'll join a collaborative penetration testing team supporting the Chief Technology Office, the infrastructure backbone of the bank. The team tests new and changing services across AWS, Google Cloud Platform and Azure; SaaS and enterprise platforms; networks; end-user computing; on-premises hosting; mainframes; engineering platforms; and AI-powered products.

This is a high-energy and transparent environment where people share ideas, ask questions and help one another. You'll work alongside experienced penetration testers and partner with other security testing chapters when priorities or specialist expertise require a broader team response.

Grow. Belong. Shape what's next.

In this role, you will:

• Deliver penetration testing across cloud, SaaS, infrastructure, networks, web applications and enterprise platforms.
• Help define the scope, approach and appropriate level of rigour for assigned testing engagements.
• Identify and safely validate vulnerabilities, demonstrating technical risk and potential business impact.
• Produce clear, practical reports that help technology teams understand findings and prioritise remediation.
• Collaborate with engineers, platform teams, service owners and other security testing chapters.
• Contribute to improvements in testing methods, tooling, automation and team practices.
• Explore responsible uses of AI to support activities such as research, proof-of-concept scripting, analysis and testing workflows.

We're interested in hearing from people who:

Bring hands-on security testing capability, curiosity and an interest in understanding how complex technologies can be compromised and better protected. You'll enjoy collaborating with others, sharing knowledge and moving between different testing environments while continuing to develop your technical capability.

Experience in several of the following will help you succeed:

• Hands-on penetration testing across one or more areas such as web applications, infrastructure, networks, cloud or SaaS.
• Sound foundations in vulnerability identification, exploitation techniques and penetration testing methodologies.
• The ability to explain technical findings clearly and recommend practical remediation.
• Familiarity with penetration testing tools and platforms, which may include Kali Linux, Burp Suite, Metasploit or comparable technologies.
• Exposure to AWS, Google Cloud Platform or Azure environments.
• Deeper capability in network or web application testing would be valuable.
• Experience testing AI-enabled products, or using AI and automation to improve penetration testing workflows, is highly desirable.
• Relevant security certifications are advantageous.

Working with us:

At CommBank, we're committed to creating an accessible, inclusive and respectful workplace. If you require support or adjustments, please let us know. We welcome applications from people of all backgrounds and we're particularly committed to making a positive difference for Aboriginal and/or Torres Strait Islander Peoples. For support please contact 1800 989 696.

We're aware of some accessibility issues