Penetration Tester

About the role

One NZ is looking for a Penetration Tester to drive the identification and remediation of security weaknesses across its services. You will work with senior cyber‑security staff to perform authorised offensive testing on applications, infrastructure, cloud platforms, APIs, identity systems, AI, containers and Kubernetes.

Key responsibilities

• Plan and execute authorised penetration tests on applications, APIs, infrastructure, cloud, identity and end‑user environments.
• Conduct threat‑led and scenario‑based testing to simulate real‑world attacker behaviour.
• Assess security of web, mobile, API and thick‑client applications against relevant standards.
• Evaluate container and Kubernetes environments, including RBAC and workload isolation.
• Test Gen AI and agentic solutions for attack paths such as prompt injection and data leakage.
• Review identity and access controls, authentication flows, privileged access and lateral movement risks.
• Produce detailed reports with risk findings, evidence, exploitability and prioritised remediation actions.
• Partner with engineering teams to support remediation, deliver debriefs and validate fixes through retesting.
• Contribute to improving offensive security tooling, automation and playbooks.
• Support purple‑team exercises and incident‑readiness activities with Cyber Defence teams.

Required profile

• Proven hands‑on experience delivering penetration testing across applications and infrastructure in an enterprise environment.
• Strong understanding of Windows and Linux security, networking fundamentals and common attack techniques.
• Experience testing web, API and mobile applications.

Required skills

• Penetration testing
• Web application security
• API security
• Mobile application security
• Container security
• Kubernetes security
• Cloud security
• Identity and Access Management
• Windows security
• Linux security
• Networking fundamentals