Senior Analyst - Penetration Tester

About the role

McGrathNicol, an independent professional services firm covering Cyber, Deals, Forensic, Performance, Restructuring and Risk & Compliance, is looking for a Senior Analyst - Offensive Security to join its Advisory division in Sydney. The role suits someone with a strong hands-on technical background in offensive security who enjoys finding vulnerabilities and mentoring junior team members. You will deliver penetration testing engagements across infrastructure, web applications, cloud platforms and operational technology (OT).

Key responsibilities

• Deliver offensive security engagements, including penetration testing and supporting activities for red team and threat emulation exercises.
• Perform hands-on testing, analyse technical weaknesses, validate risk and provide practical remediation recommendations.
• Assess enterprise technologies such as Microsoft 365, Azure, AWS, GCP and hybrid infrastructure.
• Review code during application security assessments and give secure development guidance.
• Write technical reports and explain findings to technical and non-technical stakeholders.
• Work with engagement managers and senior team members to deliver work on time and to a high standard.
• Support testing preparation, evidence management and quality assurance, and share knowledge with juniors.

Required profile

• At least 3 years of hands-on penetration testing or closely related offensive security experience.
• Demonstrated hands-on capability in at least two of: web application and API testing, mobile application testing, thick client testing, internal and external infrastructure testing, cloud security assessments, and red team operations.
• Experience using scripting and automation tools such as Python, PowerShell or Bash.
• Familiarity with OT/ICS environments and protocols is desirable.
• Relevant certifications such as OSCP, OSWE, CRTP, HackTheBox CPTS, CRTO, CREST CRT or CREST CCT are an advantage.
• Strong communication skills and the ability to work independently and within a team.

Required skills

• Offensive security methodologies, tools and frameworks such as MITRE ATT&CK, OWASP and NIST.
• Penetration testing and red teaming.
• Scripting and automation (Python, PowerShell, Bash).

What we offer

• A competitive annual bonus program.
• Training and career development with personalised mentorship.
• 26 weeks parental leave, additional leave options, employee assistance and wellbeing programs.