Penetration Tester | Brisbane CBD | $100,000 + super | relocation bonus

Decipher Bureau; Brisbane; Hybrid; AUD 100,000 - 120,000; Full time

Benefits offered by this job

Annual training allowance

Conference attendance

Paid research program (CVE incentives)

Salary packaging

Professional memberships (AISA, ISACA,

OWASP memberships

Volunteer days

Flexible WFH

Relocation bonus

Laundry service

Job summary

Decipher Bureau in Brisbane is seeking a hands-on Penetration Tester to own engagements from scoping to debrief in a growing offensive security team. You will work with clients across government, defence, and enterprise, performing tests on web apps, APIs, mobile and cloud, with peer review and QA guiding your approach.

You'll contribute to a research-driven environment, with opportunities to explore AI security and tooling.

Qualifications

• Full Australian working rights and current residence in Australia.
• Hands-on penetration testing experience end-to-end across multiple domains.
• Strong written and verbal communication for client discussions.
• Consulting or client-facing experience.
• Scripting experience in Python, PowerShell or Ruby.
• Working knowledge of CVSS, OWASP ASVS, NIST and ISO 27001/31000.

Responsibilities

• Penetration testing and vulnerability assessments across web apps, APIs, mobile, cloud and network.
• Engage in red team, social engineering and hardware engagements when required.
• Create plain-English reports for technical teams and executives.
• Assist in scoping, QA, and mentor junior testers.
• Occasionally support incident response and risk assessments.

Skills

Penetration testing

Vulnerability assessments

Client-facing

Python

PowerShell

Ruby

Tools

Burp Suite

OWASP ZAP

Nessus

Kali Linux

Job description

Penetration Tester | Brisbane CBD | $100,000 + super | relocation bonus

Hey there, pen testers. Can you already hold your own on an engagement but know there’s plenty left to learn? Want your reports peer reviewed by people who’ve done the job themselves? You might like this one...

Before getting into the detail, here’s what’s in it for you in this permanent role:

• $100,000 + super
• An annual training allowance, plus conference, meetup and team CTF attendance
• A paid research program, where you earn incentives for CVE discovery or security tool development
• Salary packaging for a car, portable electronics and super
• AISA, ISACA and OWASP memberships covered
• Up to 3 paid volunteer days a year for a cause of your choice
• Flexible WFH, with a CBD office near public transport that has fresh fruit, coffee and a weekly laundry service (yes, laundry)
• Already in Brisbane? Perfect. Coming from interstate? There’s a relocation bonus on offer to help with the move

So, what will you be stepping into?

The offensive security team is growing. It’s currently around 16 testers delivering hundreds of tests a year for clients across government, defence, education, software, critical infrastructure and enterprise. That means a lot of variety, and room to lean into the areas that interest you most.
You’ll own your engagements from scoping through to debrief, work directly with clients and have real say in how you run your day. Every engagement goes through proper peer review and QA, so you’ll be working with people who will challenge your work and help you improve it. People have joined this team in their first pentesting role and grown into principal testers and research leads.
There’s also active investment in AI security, both breaking it and building with it. If that’s an area you want to get into early, this is a good place to do it.

Day to day, you’ll be:

• Penetration testing and running vulnerability assessments across web applications, APIs, mobile, internal and external infrastructure, wireless and cloud
• Taking part in red team, social engineering and hardware engagements
• Writing plain-English reports that work for both technical teams and executives
• Helping with scoping and QA, and guiding associate testers as they find their feet
• Occasionally supporting incident response and threat and risk assessments

To succeed in a role like this, you’ll need:

• Full Australian working rights and current residence in Australia. Sponsorship isn’t available for this role
• Hands‑on penetration testing experience and the ability to run an engagement start to finish. You’re not expected to know everything, and this role suits someone still growing
• Strong written and verbal communication. You’ll be in front of clients walking through findings and explaining why they matter to the business
• Consulting or client‑facing experience
• Scripting experience in Python, PowerShell or Ruby
• Working knowledge of CVSS, OWASP ASVS, NIST and ISO 27001/31000

Decipher Bureau and the clients we partner with are committed to creating a diverse environment and are proud to be equal opportunity employers. All qualified applicants will be considered for employment without attention to race, colour, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.
Additional information

• $100k + super, Brisbane CBD, flexible WFH, Relocation Bonus
• Web, API, mobile, cloud, red team and hardware
• Training allowance, paid research and relocation bonus