Senior Offensive Security Analyst | Penetration Testing Lead

McGrathNicol; Sydney; On-site; AUD 140,000 - 190,000; Full time

Benefits offered by this job

Annual bonus

Career development

Parental leave (26 weeks)

Employee assistance programme

Health & wellbeing programs

Social & community engagement

Job summary

McGrathNicol is seeking a Senior Analyst - Offensive Security to lead hands-on penetration testing across infrastructure, web apps, cloud, and OT. You will mentor junior team members while delivering high-quality assessments and practical remediation guidance.

You will apply MITRE ATT&CK, OWASP, and NIST frameworks, work with Azure/AWS/GCP, and communicate complex findings to technical and non-technical stakeholders while upholding professional standards.

Qualifications

• 3+ years hands-on penetration testing or closely related offensive security experience.
• Strong knowledge of offensive security methodologies, tools, and frameworks (MITRE ATT&CK, OWASP, NIST).
• Experience in at least two areas: web/API testing, cloud security assessments, infrastructure testing, red team operations.

Responsibilities

• Deliver offensive security engagements including penetration testing and red team activities.
• Analyze weaknesses, validate risk, and provide remediation recommendations.
• Apply knowledge of enterprise tech (Microsoft 365, Azure, AWS, GCP, hybrid) to assess security gaps.
• Conduct code reviews as part of application security assessments and provide secure development guidance.
• Prepare high-quality technical reports and communicate findings to stakeholders.

Skills

Penetration testing

Threat emulation

Scripting/Automation

Clear communication

Independent work

Education

OSCP/OSWE/CRTP/CCT etc.

Tools

Python

PowerShell

Bash

Job description

McGrathNicol is seeking a Senior Analyst - Offensive Security to lead hands-on penetration testing across infrastructure, web apps, cloud, and OT. You will mentor junior team members while delivering high-quality assessments and practical remediation guidance.

You will apply MITRE ATT&CK, OWASP, and NIST frameworks, work with Azure/AWS/GCP, and communicate complex findings to technical and non-technical stakeholders while upholding professional standards.