Penetration Tester – Lead Offensive Security Consultant

About the role

Join a fast‑growing consulting firm in Sydney as its first technical offensive security consultant. You will lead the new in‑house penetration testing function, working directly with senior leadership and shaping the service from the ground up.

Key responsibilities

• Run end‑to‑end penetration testing engagements, from scoping to reporting.
• Test external and internal networks, web applications, APIs, Active Directory, cloud configurations, and conduct social‑engineering/phishing simulations.
• Define methodology, tooling, and reporting standards for the pen‑testing practice.
• Support the Cyber Business Development Manager with scoping and presales activities.
• Collaborate with the GRC team to align findings with compliance and risk frameworks.
• Mentor junior staff and help scale the function as the team expands.

Required profile

• 5+ years of hands‑on penetration testing experience (mid to senior level).
• Relevant certification such as OSCP or CREST (preferred).
• Experience working in compliance‑driven environments.
• Strong client‑facing communication skills.
• Self‑starter attitude with a passion for building new capabilities.

Required skills

• OSCP certification
• CREST certification
• Network penetration testing
• Web application testing
• API testing
• Active Directory assessment
• Cloud configuration review
• Social engineering and phishing simulation

What we offer

• Up to AUD 160,000 base salary plus superannuation.
• Remote‑first work model with occasional onsite client visits.
• Direct access to leadership and influence over function design.
• Opportunity to grow into a principal or lead position as the team expands.