Security Testing Lead Specialist (Contract)

About the role

Hastha Solutions is recruiting a Security Testing Lead Specialist on a 6-month contract, with possible extension, based in Sydney. The role leads high-complexity, high-assurance security assessments across customer systems, including penetration testing, vulnerability assessments and source code security reviews, and acts as the primary escalation point for complex vulnerabilities and adversary emulation. It suits Australian/NZ citizens or PR holders.

Key responsibilities

• Lead and deliver complex security assessments, including penetration testing, vulnerability assessments and source code security reviews, with a focus on real-world exploitability and attack paths.
• Evaluate the effectiveness of systems in protecting data and provide strategic recommendations to improve security posture.
• Identify and validate critical vulnerabilities and attack vectors, translating technical findings into business risk insights.
• Drive the evolution of security testing strategy, methodology and standards, and collaborate with the Security Testing Senior Lead and cyber security teams.
• Assess existing security controls, recommend improvements, and ensure high-quality assessment reports with clear risks, impacts and mitigations.
• Mentor senior and junior team members, develop training, promote shift-left practices, and guide application security architecture and secure design.
• Develop scripts, contribute to automation, refine engagement processes and secure code artefacts, and review deliverables from the Secure Code team.
• Work with vendors and newly acquired entities to uplift their security practices, and respond to escalated incidents and engagements.

Required profile

• A minimum of 8 years' experience in a Security Testing role.
• Significant experience performing complex security assessments in a large corporate environment and implementing automated security assessment tools in CI/CD pipelines.
• Tertiary qualification in Electrical/Electronic, Computer, Network or Software Engineering, Information/Cyber Security, IT or a related discipline.
• Demonstrable skills beyond those expected of an OSCE/OSWE or CREST certified professional.
• Highly desirable: prior developer experience, experience writing security policy and standards, and current certifications such as OSCP, OSCE, OSWE, CREST, SANS or (ISC)2.

Required skills

• Vulnerability scanners, static code analysis and software composition analysis tools.
• Application security architecture, including transport security, authentication, authorisation, threat modelling and logging and monitoring.
• Experience training and developing people.