Hybrid Penetration Tester - Web, API & Mobile Security

Elevate Resourcing; Auckland; Hybrid; NZD 90,000 - 120,000; Full time

Job summary

Elevate Resourcing – Auckland, New Zealand, is seeking an experienced Penetration Tester to join a cybersecurity start-up client. You will perform offensive security assessments across infrastructure, cloud, and applications, focusing on web, API, and mobile testing, with strong emphasis on delivering clear, actionable risk guidance.

You’ll produce structured reports, work with diverse clients, and contribute to tooling and methodologies while collaborating with a skilled team.

Qualifications

• 3+ years hands-on experience in penetration testing or application security
• Strong knowledge of application-layer vulnerabilities and secure development practices
• Experience testing REST/GraphQL APIs and iOS/Android mobile apps
• Proficient in Burp Suite, OWASP ZAP, Postman, Nmap and custom scripts
• Certifications such as OSCP/OSWE/GWAPT are valued
• Excellent written and verbal communication skills

Responsibilities

• Plan and conduct penetration testing engagements across multiple domains
• Web applications and APIs testing
• Mobile applications testing (iOS and Android)
• Internal and external networks testing
• Cloud platforms and configurations assessment
• Document findings in structured reports and client debriefs
• Provide remediation guidance to technical and non-technical stakeholders
• Contribute to tooling, methodologies, and team knowledge sharing
• Support red and purple team exercises when required

Skills

Penetration testing

App security

Burp Suite

OWASP ZAP

Postman

Nmap

Custom scripts

API testing

Mobile testing

Secure SDLC

Certifications

Communication

Tools

Burp Suite

OWASP ZAP

Postman

Nmap

Custom scripts

Job description

Elevate Resourcing – Auckland, New Zealand, is seeking an experienced Penetration Tester to join a cybersecurity start-up client. You will perform offensive security assessments across infrastructure, cloud, and applications, focusing on web, API, and mobile testing, with strong emphasis on delivering clear, actionable risk guidance.

You’ll produce structured reports, work with diverse clients, and contribute to tooling and methodologies while collaborating with a skilled team.