Senior Penetration Testing Lead

Westpac New Zealand Limited; New Zealand; Remote; NZD 120,000 - 180,000; Full time

Benefits offered by this job

4 weeks holiday

5 wellbeing days

Banking benefits

Growth & internal mobility

Volunteer days

Job summary

Westpac New Zealand Limited is seeking a Senior Information Security Consultant (Penetration Testing) to plan, lead and deliver authorised security testing across technology services. You will identify exploitable weaknesses, demonstrate attack paths, and advise remediation with stakeholders across risk, engineering and third parties.

The role requires strong experience in multiple testing domains, secure coding awareness, and the ability to produce high-quality reports for diverse audiences.

Qualifications

• Demonstrated experience independently delivering penetration testing in large enterprise environments.
• Broad testing domains including web, API, network, cloud, and mobile security.
• Strong knowledge of Windows/Linux security, AD, networking, DNS, HTTP/S, and API security.
• Ability to write clear, actionable security reports for technical and non-technical audiences.

Responsibilities

• Plan, lead and deliver authorised security testing across Westpac NZ technology services.
• Identify exploitable weaknesses, demonstrate attack paths and advise remediation.
• Collaborate with engineering, risk and third parties to verify remediation and improve processes.

Skills

Penetration testing

Cloud security

Reporting skills

Python scripting

DevSecOps knowledge

Public cloud platform

Tools

Kubernetes

Docker

OpenShift

CI/CD tooling

Automation scripting

Job description

Westpac New Zealand Limited is seeking a Senior Information Security Consultant (Penetration Testing) to plan, lead and deliver authorised security testing across technology services. You will identify exploitable weaknesses, demonstrate attack paths, and advise remediation with stakeholders across risk, engineering and third parties.

The role requires strong experience in multiple testing domains, secure coding awareness, and the ability to produce high-quality reports for diverse audiences.