This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
Lift CSIRO’s cyber maturity by leading high impact security testing capability; Run threat informed offensive security across a complex environment; Be the trusted technical lead driving measurable remediation outcomes
Job Responsibility:
Lead the planning and coordination of security testing activities (i.e. penetration testing and red teaming activities, including scheduling, stakeholder alignment, and rules of engagement
Perform and oversee penetration tests on web applications, bespoke systems, complex and sensitive infrastructure, and cloud services, ensuring safe execution and minimal operational impact
Document, validate and prioritise findings
produce clear, timely reports and briefings that communicate risk, impact, and practical remediation options to technical and non-technical stakeholders
Develop and maintain testing methodologies, scoping documents, rules of engagement and repeatable playbooks for environments that do not fit standard IT patterns, including threat-informed and adversary emulation approaches
Carry out quality assurance and peer review for testing deliverables, ensuring consistency of evidence, severity ratings, and remediation guidance
Stay current with evolving threats, attacker TTPs, and security trends
evaluate and improve tooling and techniques used by the testing function
Partner with vulnerability management, cyber architecture/engineering and detection/response teams to validate risk, support remediation, and uplift defensive controls through purple-team style collaboration
Requirements:
4+ years of hands-on experience in penetration testing (or similar), including coordinating end-to-end engagements (scoping, execution, reporting) and working effectively across multiple stakeholders
Understanding of scripting languages such as Python, PowerShell and Bash
Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defence-in-depth)
Knowledge of application vulnerabilities and experience conducting application vulnerability assessments
Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language (PL/SQL) and injections, malicious code)
Demonstrated experience in penetration testing principles, tools, and techniques
Proven capability in executing comprehensive web application testing
Demonstrated ability to mentor and uplift junior testers through coaching, structured feedback, and review of technical deliverables
Experience designing or delivering threat-informed testing (e.g., attack simulation, adversary emulation, or red team techniques), with a strong focus on safety, authorisation and clear rules of engagement
OSCP/GPEN/OSWE/CRTO equivalent certification or relevant industry experience
Excellent reporting, presentation and communication skills, including the ability to brief executives, facilitate technical deep-dives, and drive remediation discussions
Nice to have:
Experience with threat hunting, detection engineering, or purple teaming to validate and improve defensive controls
Perform code analysis services to identify potential security issues
Technical experience reviewing the security configuration of on-premises and/or cloud-based enterprise technologies
Experience with OT and IoT environments
Experience in providing mentoring to cyber security staff
Familiarity with: Mitre Attack Framework
CVSS 3.1
Experience with cyber security frameworks including Australian Government Information Security Manual (ISM), Protective Security Policy Framework (PSPF) and Essential 8 (E8)