Penetration Tester

About the role

CommBank is hiring a Penetration Tester in Sydney to deliver hands-on security testing across cloud, platforms, networks, SaaS and emerging technologies. The role sits within Group Security, part of Technology, and joins a collaborative team supporting the Chief Technology Office that tests services on AWS, Google Cloud Platform and Azure, SaaS and enterprise platforms, networks, end-user computing, on-premises hosting, mainframes, engineering platforms and AI-powered products.

Key responsibilities

• Deliver penetration testing across cloud, SaaS, infrastructure, networks, web applications and enterprise platforms.
• Help define the scope, approach and level of rigour for each testing engagement.
• Identify and safely validate vulnerabilities, showing technical risk and potential business impact.
• Produce clear, practical reports that help technology teams understand findings and prioritise remediation.
• Collaborate with engineers, platform teams, service owners and other security testing chapters.
• Contribute to improvements in testing methods, tooling, automation and team practices.
• Explore responsible uses of AI to support research, proof-of-concept scripting, analysis and testing workflows.

Required profile

• Hands-on security testing capability, curiosity about how complex technologies can be compromised and an interest in protecting them.
• Ability to collaborate, share knowledge and move between different testing environments.
• Experience in several of the listed areas is helpful.
• Relevant security certifications are advantageous.

Required skills

• Hands-on penetration testing in one or more areas such as web applications, infrastructure, networks, cloud or SaaS.
• Sound foundations in vulnerability identification, exploitation techniques and penetration testing methodologies.
• Ability to explain technical findings clearly and recommend practical remediation.
• Familiarity with tools such as Kali Linux, Burp Suite or Metasploit.
• Exposure to AWS, Google Cloud Platform or Azure environments.
• Deeper capability in network or web application testing is valuable; experience testing AI-enabled products or using AI and automation to improve testing workflows is highly desirable.