Penetration Tester

About this role

AI Job Summary

• Minimum 4 years' industry cybersecurity work in a similar penetration testing role.
• Strong background in mobile app and API penetration testing (Android and iOS).
• Produce well-written, evidence-based security reports and discuss solutions with stakeholders.

Sign up or log in to analyse my fit

Role Type

Permanent • Full-time • Mid-level Senior

Description

The Mission

We are here to find those who strive for excellence, go the extra mile, and crave continuous growth.

We’re an all-Australian cybersecurity firm helping some of the country’s biggest organisations stay ahead of cyber risk. Proudly recognised as a 2026 Great Place to Work®, we’ve built a culture that champions growth, celebrates initiative, and supports people who are motivated to make an impact. We’re looking for people who share our drive to learn relentlessly, act with integrity, and raise the bar for our clients and teammates alike – those seeking a place where your drive and expertise are met with equal enthusiasm and opportunity. Dive into a culture that treasures innovation and offers a growth platform that is as limitless as your ambition and work ethic.

The Opportunity

We’re looking for a**Penetration Tester to join our existing and growing team. Whilst we’d prefer a Melbourne or Sydney-based candidate, we’re open to candidates anywhere within Australia. The role reports to the Head of Penetration Testing and will see you working within an experience testing team, solving our client’s cybersecurity issues, sharing your knowledge, and mentoring others.

What You’ll Be Responsible For

• Design and execute tests to break into security protected networks, computer systems and web-based applications, and mobile applications to look for vulnerabilities. Test design will be based on threat intelligence, OSINT, or client scenarios
• Conduct physical assessments of client locations, server systems and network device security, looking for ways to exploit vulnerabilities
• Conduct security and network configuration audits to evaluate how well an organizations’ system conforms to a set of established criteria and best practice frameworks
• Analyze organizational security policies for effectiveness, make suggestions for improvements.
• Document your findings, write evidence-based security reports, and discuss solutions with IT stakeholders, senior management teams, and C-Suite leaders

What We’re Looking For

• Min 4 years’ industry work experience within Cybersecurity in a similar Penetration Testing role (DevOps IT SysAdmin, or IT analyst background desired but not required)
• Industry recognized certifications: OSCP, OSEP, CRTO, SANS/GIAC, PNPT, ECPPTv2
• Previous experience in a customer facing and/or a consulting-type role delivering a wide variety of end-to-end testing
• A strong background in Mobile Apps and API Penetration testing (Android and iOS)
• Low level programming language experience (desired but not required)
• A natural problem solver with the ability to multi-task and apply analytical thinking to solve a range of testing issues and well as produce well-written, evidence-based reports.
• Excellent communication skills – both written and verbal
• Strong collaboration skills – you’ll be working with a variety of teams within the organisation to solve client requirements

What You’ll Get

• A competitive base salary
• Flexibility, autonomy, and support with a clear investment in your development
• A collaborative, technically excellent team to be part of

Company Overview

At ctrl:cyber, cyber together goes beyond a mission—it’s our way of leading the charge. It’s about partnering with our clients, the broader industry, and like-minded innovators to create real change. It’s about building up our community and driving progress as a collective force. Advancing the industry takes everyone moving forward together. ctrl:cyber is the trusted cybersecurity partner for industry leaders and global brands, providing tailored solutions to align with business objectives, ensuring the unique needs of each organisation are met. Our core service offerings include; Risk Operations Centre – Advanced Cyber Monitoring, Penetration Testing, Cyber Advisory, Cyber Engineering, DFIR and Privacy, Data and AI Governance.

About cyber security & digital forensics roles for ex-police

Cyber security, digital forensics and incident-response roles. DMIs, cybercrime investigators and digital forensics officers bring evidential discipline and investigative judgement that DFIR and security teams struggle to hire.