Senior Cyber Security Testing Lead (Adversary Emulation)

Australian Energy Market Operator (AEMO); Sydney; Hybrid; AUD 140,000 - 190,000; Full time

Benefits offered by this job

Flexible working

Volunteer leave

Performance bonuses

Wellness program

Discounted health insurance

EAP

Job summary

AEMO’s Cyber Defence team seeks a senior tester to lead security testing across applications, infrastructure and cloud, including research‑driven tooling. You will guide scoping with asset owners, report vulnerabilities with practical remediation guidance, and support incident response on rotation.

You will bring offensive security credentials (OSCP preferred), hands‑on testing across web, API, network and cloud environments (Azure), and experience in risk‑based vulnerability management and

Qualifications

• OSCP or equivalent offensive security certification.
• Experience leading end-to-end testing engagements with asset owners.
• Hands-on security testing across web apps, APIs, networks and cloud.
• Familiarity with MITRE ATT&CK and adversary emulation.

Responsibilities

• Lead scoping of testing engagements with asset owners and stakeholders.
• Conduct hands-on security testing and report vulnerabilities with remediation guidance.
• Research and test internally developed tooling to assess security posture.
• Peer review test scopes and reports for technical accuracy and consistency.
• Develop and maintain testing processes and playbooks for the team.

Skills

OSCP

End-to-end testing

Adversary emulation

MITRE ATT&CK

Vulnerability management

Tools

Microsoft Azure

Job description

AEMO’s Cyber Defence team seeks a senior tester to lead security testing across applications, infrastructure and cloud, including research‑driven tooling. You will guide scoping with asset owners, report vulnerabilities with practical remediation guidance, and support incident response on rotation.

You will bring offensive security credentials (OSCP preferred), hands‑on testing across web, API, network and cloud environments (Azure), and experience in risk‑based vulnerability management and