Penetration Tester

CommBank; Sydney; On-site; AUD 120,000 - 180,000; Full time

Job summary

CommBank is seeking a Penetration Tester to deliver hands-on testing across cloud, networks, SaaS, and enterprise platforms. You will identify and validate vulnerabilities, demonstrate potential business impact, and provide remediation guidance within a high-energy cybersecurity team.

The role values curiosity, collaboration, and knowledge-sharing as the threat landscape evolves, including AI-powered testing workflows.

Qualifications

• Hands-on security testing capability across cloud, networks, SaaS and web applications.
• Ability to explain technical findings clearly and recommend remediation actions.
• Experience with AI-enabled testing or using AI to improve workflows is advantageous.
• Relevant security certifications are advantageous.

Responsibilities

• Deliver penetration testing across cloud, SaaS, infrastructure, networks, web applications and enterprise platforms.
• Help define the scope, approach and appropriate level of rigour for assigned testing engagements.
• Identify and safely validate vulnerabilities, demonstrating technical risk and potential business impact.
• Produce clear, practical reports that help technology teams understand findings and prioritise remediation.
• Collaborate with engineers, platform teams, service owners and other security testing chapters.
• Contribute to improvements in testing methods, tooling, automation and team practices.
• Explore responsible uses of AI to support activities such as research, proof-of-concept scripting, analysis and testing workflows.

Skills

Penetration testing

Cloud security testing

Network security testing

SaaS testing

Web applications testing

Tools

Kali Linux

Burp Suite

Metasploit

Job description

• Deliver hands-on penetration testing across cloud, platforms, networks, SaaS and emerging technologies.
• Join an energetic and transparent team where curiosity, collaboration and knowledge-sharing are valued.
• Explore how AI and automation can strengthen security testing and help protect the bank and its customers.

Penetration Tester

• Deliver hands-on penetration testing across cloud, platforms, networks, SaaS and emerging technologies.
• Join an energetic and transparent team where curiosity, collaboration and knowledge-sharing are valued.
• Explore how AI and automation can strengthen security testing and help protect the bank and its customers.

Bring your ambition and we'll help you grow, belong and shape what's next in cyber security.

Do work that matters

As a Penetration Tester, you'll deliver technical security testing that helps strengthen the bank's security and risk posture. You'll identify and validate vulnerabilities, demonstrate their potential impact and provide practical recommendations that support effective remediation.

The work is broad and often more complex than standard web application testing. You'll assess platforms and services spanning cloud, networks, infrastructure, SaaS, observability and logging, engineering tools and emerging AI-powered technologies.

You don't need to specialise in every area. We're looking for someone with solid penetration testing foundations, the adaptability to work across different technologies and the curiosity to keep learning as the threat and technology landscape evolves.

See yourself in our team

Group Security is part of Technology and brings together cyber security, protective security, business resilience, fraud technology and cyber defence capabilities. Its purpose is safeguarding a brighter future for all by securing the bank, protecting customers, building recovery capability and creating an admired place to work.

You'll join a collaborative penetration testing team supporting the Chief Technology Office, the infrastructure backbone of the bank. The team tests new and changing services across AWS, Google Cloud Platform and Azure; SaaS and enterprise platforms; networks; end-user computing; on-premises hosting; mainframes; engineering platforms; and AI-powered products.

This is a high-energy and transparent environment where people share ideas, ask questions and help one another. You'll work alongside experienced penetration testers and partner with other security testing chapters when priorities or specialist expertise require a broader team response.

Grow. Belong. Shape what's next.

In this role, you will:

• Deliver penetration testing across cloud, SaaS, infrastructure, networks, web applications and enterprise platforms.
• Help define the scope, approach and appropriate level of rigour for assigned testing engagements.
• Identify and safely validate vulnerabilities, demonstrating technical risk and potential business impact.
• Produce clear, practical reports that help technology teams understand findings and prioritise remediation.
• Collaborate with engineers, platform teams, service owners and other security testing chapters.
• Contribute to improvements in testing methods, tooling, automation and team practices.
• Explore responsible uses of AI to support activities such as research, proof-of-concept scripting, analysis and testing workflows.

We're interested in hearing from people who:

Bring hands-on security testing capability, curiosity and an interest in understanding how complex technologies can be compromised and better protected. You'll enjoy collaborating with others, sharing knowledge and moving between different testing environments while continuing to develop your technical capability.

Experience in several of the following will help you succeed:

• Hands-on penetration testing across one or more areas such as web applications, infrastructure, networks, cloud or SaaS.
• Sound foundations in vulnerability identification, exploitation techniques and penetration testing methodologies.
• The ability to explain technical findings clearly and recommend practical remediation.
• Familiarity with penetration testing tools and platforms, which may include Kali Linux, Burp Suite, Metasploit or comparable technologies.
• Exposure to AWS, Google Cloud Platform or Azure environments.
• Deeper capability in network or web application testing would be valuable.
• Experience testing AI-enabled products, or using AI and automation to improve penetration testing workflows, is highly desirable.
• Relevant security certifications are advantageous.

Working with us:

At CommBank, we're committed to creating an accessible, inclusive and respectful workplace. If you require support or adjustments, please let us know. We welcome applications from people of all backgrounds and we're particularly committed to making a positive difference for Aboriginal and/or Torres Strait Islander Peoples. For support please contact 1800 989 ***.

Advertising End Date: 29/10/2026