Senior Penetration Tester – Web App & API Specialist

phew Limited; New Zealand; Hybrid; NZD 110,000 - 190,000; Full time

Benefits offered by this job

Growth opportunities

Collaborative team

Hands-on variety of targets

Security training and certifications

Study leave and course costs

WFH flexibility

Auckland central office access

Job summary

phew Limited, Auckland, NZ, is seeking an experienced Senior Penetration Tester to join a quality-focused cyber security team. You will conduct deep penetration tests across web, mobile, and API targets for diverse clients, and guide security improvements from discovery to remediation.

You will mentor juniors, engage with clients, and contribute to testing frameworks, tooling, and methodologies. Sponsorship for suitable candidates planning a move to NZ is available; hybrid work with office in

Qualifications

• 3-5+ years of full-time penetration testing experience focusing on web, mobile apps and APIs.
• Strong programming knowledge and hands-on source code review experience.
• Proven security research or bug bounty track record with CVE credits or recognised competitions.
• Ability to self-manage and deliver clear, high-quality reports.
• Strong English and clear communication of security concepts.
• Experience with OWASP, NIST, Burp Suite and Kali Linux.
• OSCP and/or OSWE / OSEP / OSCE or equivalent certifications.

Responsibilities

• Conduct comprehensive penetration testing across web, mobile, and API targets for diverse clients.
• Perform network and infrastructure security assessments (wired, wireless, internal, external).
• Mentor junior team members.
• Engage with clients throughout engagements, guiding testing strategy and delivering actionable advice.
• Contribute to security assurance strategies, tools, and methodologies.
• Integrate security activities within client and internal projects.

Skills

Penetration testing

Source code review

Bug bounty

Security research

Technical reporting

English communication

OWASP / NIST

Education

OSCP, OSWE, OSCE / OSEP certifications

Tools

Burp Suite

Kali Linux

Job description

Senior Penetration Tester

At phew we offer penetration testing, security assurance, and related cyber security services to a wide range of New Zealand and international clients, from innovative SaaS start-ups to publicly listed and critical infrastructure providers. Due to a high level of demand for our services, we have an exciting opportunity for an experienced Penetration Tester to join our quality-focused and talented team.

What can we offer you at phew?

• Real growth opportunities and the ability to shape your role and the strategies of the testing team
• A tight-knit team with a focus on collaborative working and knowledge sharing
• Hands-on exposure to diverse targets and projects, with plenty of autonomy, and a real impact on the quality of the business solutions we deliver to our clients
• Structured security research time that grows with seniority and experience
• Strong focus on upskilling and certification, with support through study leave and course costs
• Modern work culture, with flexibility for WFH and time in our central Auckland office

Key responsibilities:

• Conduct comprehensive penetration testing across web, mobile, and API targets for diverse clients and targets
• Perform network and infrastructure security assessments (wired, wireless, internal, external)
• Mentor junior team members
• Engage directly with clients throughout the engagement lifecycle, guiding the testing strategy and providing actionable advice
• Contribute to the team’s security assurance strategies, tools, and methodologies to ensure effective outcomes
• Integrate security assurance activities within client and internal projects

What we’re looking for (please do not apply unless you have evidence of meeting the following requirements for this role)

• 3-5+ years of full-time penetration testing experience with a particular focus on source code supported testing of web and mobile apps and APIs
• A strong working knowledge of a variety of programming languages, and extensive hands-on experience with source code review
• A strong track record in security research or bug bounty activities, with verifiable achievements such as CVE credits for high severity vulnerabilities (RCE, SSRF, Deserialization, or SQLi), or participation in reputable CTFs or recognised bug bounty programs
• Ability to self-manage and deliver clear, high-quality reports
• Strong English and clear communication skills, with the ability to communicate security and vulnerability concepts and findings with clarity
• In-depth knowledge and experience with penetration testing frameworks, tools and methodologies, such as OWASP and NIST, Burp Suite and Kali Linux
• Certifications in OSCP (or close equivalent), with OSWE, OSEP, OSCE+ preferred, and/or other certs from Offensive Security, GIAC, CREST
• Smart, self-motivated and skilled individuals who really want to take the next step in developing their career

We can assist with work visa sponsorship for suitably qualified candidates who are actively planning a move to NZ.