Penetration Tester - Offensive Security Consultant

About the Role

As a Penetration Tester at Spartans Security, you will deliver penetration testing and technical security assessments across a range of client environments.

You will be involved throughout the engagement lifecycle, including preparation, technical testing, evidence collection, client communication, reporting, remediation guidance and retesting.

The role provides exposure to different technologies, industries and security environments, with opportunities to develop both technical and consulting capabilities while contributing to the continued improvement of our penetration testing services.

Key Responsibilities

• Conduct penetration testing across internal and external infrastructure, web applications, APIs, wireless networks and cloud environments.
• Identify, validate and safely demonstrate security vulnerabilities and potential attack paths.
• Perform vulnerability assessments, security configuration reviews and other technical security assessments where required.
• Analyse identified vulnerabilities to determine their technical impact and realistic risk to the client.
• Produce clear, accurate and professional penetration testing reports for technical and non-technical audiences.
• Provide practical remediation recommendations to help clients address identified security risks.
• Communicate directly with clients throughout engagements, including testing coordination, progress updates, technical discussions and report walkthroughs.
• Perform retesting to validate the remediation of previously identified vulnerabilities.
• Maintain accurate testing evidence and engagement documentation.
• Contribute to the improvement of testing methodologies, internal tooling, reporting standards and technical processes.
• Research emerging vulnerabilities, attack techniques, security tooling and technologies relevant to penetration testing.
• Collaborate with other consultants and security teams across Spartans Security where broader security expertise is required.

Experience and Skills

• Minimum two years of professional penetration testing experience, preferably within a consulting or professional services environment, or demonstrable equivalent technical capability supported by a recognised hands-on certification such as OSCP.
• Practical experience conducting security testing across enterprise environments, whether through professional engagements, structured labs or equivalent hands-on experience.
• Strong understanding of penetration testing methodologies, tools and techniques.
• Good understanding of Windows and Linux environments, Active Directory, networking and common enterprise technologies.
• Understanding of common web application and API security vulnerabilities, including the OWASP Top 10.
• Ability to analyse vulnerabilities and demonstrate their impact within controlled and authorised environments.
• Strong analytical, troubleshooting and problem-solving skills.
• Strong written communication skills with the ability to produce professional client-facing reports.
• Strong verbal communication skills and confidence communicating directly with clients.
• Ability to work independently as well as collaboratively within a consulting team.
• Ability and willingness to continually develop technical knowledge and learn new technologies.

Qualifications and Certifications

• Tertiary qualification in cyber security, information technology or a related field, or equivalent practical industry experience.
• OSCP, CREST or another recognised hands-on penetration testing certification is highly regarded, particularly for candidates with limited commercial penetration testing experience.
• Additional offensive security or specialist security certifications are desirable.

Desirable Experience

Experience in one or more of the following areas would be beneficial:

• Active Directory security and privilege escalation.
• Microsoft 365 and Azure security assessments.
• Mobile application penetration testing.
• Social engineering and phishing assessments.
• Red teaming, adversary simulation or purple team activities.
• Source code review.
• Scripting and automation using PowerShell, Python, Bash or similar languages.
• AI and LLM security testing.
• Hardware, IoT or OT security testing.
• Security research, vulnerability disclosure, CVEs, CTFs or bug bounty programs.

Location and Working Arrangements

• This is a Melbourne-based position.
• The role operates under a hybrid working arrangement, with a minimum of three days per week in our Melbourne office when not engaged in onsite customer delivery. During onsite engagements, attendance will follow customer and engagement requirements, with flexibility to work remotely where appropriate.
• Applicants must be based in Melbourne or willing to relocate to Melbourne.
• Interstate travel may occasionally be required depending on client and engagement requirements.
• Applicants must have appropriate Australian working rights.

What We Are Looking For

We are looking for someone who is technically curious, practical and motivated to continue developing their offensive security capabilities.

As this is a consulting role, technical capability is only part of the job. You should be comfortable working directly with clients, explaining technical risks clearly and providing practical recommendations that help organisations improve their security posture.

We value consultants who take ownership of their engagements, maintain high standards of testing and reporting, share knowledge with the wider team and are willing to investigate unfamiliar technologies and attack surfaces.

Working at Spartans Security

You will have the opportunity to work across a variety of penetration testing engagements, technologies and client environments while developing both your technical and consulting skills.

You will work alongside other security professionals, contribute to internal research and knowledge sharing, and have opportunities to develop capabilities across emerging areas of offensive security.