Penetration Testing Program Lead – Hybrid

ASX; Sydney; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid working options

Job summary

ASX seeks a senior cybersecurity professional to join the Cyber Architecture and Assurance team. You’ll coordinate ASX’s end-to-end penetration testing program, work with external providers and drive governance, remediation and risk-based testing across complex environments.

You’ll lead scoping, engagement governance, and test readiness, translating findings into actionable improvements. The role demands collaboration with technology, application, cloud, and business teams to strengthen control

Qualifications

• Background in information security, penetration testing principles, vulnerability assessment and risk-based security assurance.
• Exposure to the delivery lifecycle for security testing or assurance engagements, including planning, scope governance, readiness management, execution oversight, reporting or remediation follow-up.
• Experience working with external security vendors or penetration testing service providers, including delivery coordination, quality review or performance follow-up.
• Ability to translate project, system and control risk into clear testing objectives, rules of engagement, readiness expectations and remediation priorities.
• Exposure to penetration testing across complex technology environments, such as applications, APIs, infrastructure, cloud platforms and critical business systems.
• Ability to influence stakeholders and drive accountability across technology, project, application, infrastructure, cloud, business and vendor teams.
• Working knowledge of engagement governance, including roles and responsibilities, readiness criteria, escalation paths, reporting cadence and quality expectations.
• Working knowledge of contemporary security testing methodologies, common vulnerability classes and relevant cyber security frameworks or regulatory expectations.

Responsibilities

• Coordinate ASX’s end-to-end penetration testing program, including annual planning, project-based testing, engagement governance, vendor delivery, reporting, closure and remediation follow-up.
• Coordinate Red Team and Purple Team activities, ensuring exercises are appropriately scoped, governed, safely executed and translated into actionable control improvement opportunities.
• Own the scope definition and rules of engagement for penetration testing, ensuring coverage is risk-based, complete, agreed by accountable system and project owners, and aligned to system criticality, project risk, technology change and threat exposure.
• Manage relationships with external penetration testing providers, ensuring engagements are appropriately planned, governed, delivered and assessed against agreed quality expectations.
• Support budget allocation, forecasting and tracking for penetration testing and related assurance activities, including provider spend, planned testing demand and delivery risks.
• Drive internal readiness for regular and project-based penetration tests, holding project, system and platform owners accountable for providing testable environments, required access, approved connectivity, stakeholder support, test windows and safe execution constraints.
• Establish and manage engagement governance, including readiness criteria, go/no-go decision points, escalation paths, daily status reporting, issue management, SOW coordination and closure criteria.
• Act as the central escalation and decision point during live testing, removing blockers, coordinating rapid issue resolution, tracking coverage against agreed scope, and ensuring high or critical findings are communicated promptly.
• Hold technology, application, cloud, infrastructure, business and vendor teams accountable for triaging findings, agreeing remediation actions, tracking closure and escalating material risks where obligations are not being met.
• Evaluate, pilot and integrate AI-enabled or automated penetration testing capabilities into the broader cyber assurance and security testing strategy.
• Communicate testing outcomes, themes, delivery risks and risk insights clearly to technical teams, senior stakeholders and non-technical audiences.

Skills

Information security

Penetration testing

Vulnerability assessment

Risk-based security assurance

Security testing lifecycle

External security vendors

Testing objectives

Penetration testing across complex env

Stakeholder influence

Engagement governance

Security testing methodologies

Job description

ASX seeks a senior cybersecurity professional to join the Cyber Architecture and Assurance team. You’ll coordinate ASX’s end-to-end penetration testing program, work with external providers and drive governance, remediation and risk-based testing across complex environments.

You’ll lead scoping, engagement governance, and test readiness, translating findings into actionable improvements. The role demands collaboration with technology, application, cloud, and business teams to strengthen control