Senior Cybersecurity Consultant - Penetration Tester

About the role

Datacom, one of Australasia's leading technology providers, is hiring a Senior Cybersecurity Consultant within its Application Security Team. You will drive offensive security capabilities across penetration testing, Breach & Attack Simulations (BAS) and AI Red Teaming, delivering assessments to external customers and internal teams. The role is open anywhere in New Zealand, with a preference for where there is a Datacom office.

Key responsibilities

• Perform comprehensive penetration testing on applications, APIs, networks and systems using manual and automated methods.
• Design and run BAS campaigns to test detection and response across customer environments.
• Run AI Red Teaming assessments on machine learning models, LLMs and AI apps, covering prompt injection, model poisoning and data extraction.
• Formulate attack plans, test cases and working exploits during engagements.
• Support threat modelling and secure code reviews, and deliver remediation workshops to clients.
• Prepare detailed reports with findings and remediation recommendations, and collaborate with security teams on testing capabilities.
• Conduct R&D to improve offensive security and stay up to date with emerging threats and AI security risks.

Required profile

• Proven experience in offensive security and penetration testing in an enterprise or consulting setting.
• Experience or strong interest in BAS, AI Red Teaming and emerging offensive techniques.
• Knowledge of application security, secure coding and threat modelling, able to support secure code reviews.
• Ability to explain technical findings to technical and non-technical audiences, including executives.
• Relevant certifications such as OSCP, eCPPT, eWPT, PNPT, GWAPT, eMAPT, OSWE, OSEP or CRTO.

Required skills

• Proficiency with offensive security tools (Nmap, BurpSuite, Metasploit, Cobalt Strike, BloodHound, Kali Linux); BAS platform experience desirable.
• Programming and scripting (Python, Bash, PowerShell, JavaScript) for automation, exploit development and code analysis.
• Penetration testing methodologies (OWASP WSTG, OWASP ASVS, PTES, NIST SP 800-115) and frameworks (NZISM, MITRE ATT&CK, NIST, CIS).

What we offer

• Paid parental leave and a 24/7 Employee Assistance Programme.
• Ongoing learning, certifications and career development, plus access to learning platforms.
• Recognition programmes, employee discounts and financial wellbeing benefits.