Careers · Penetration testing
Penetration testers wanted. Find the way in.
We are hiring people who break into systems for a living and can explain, in plain words, how they did it. The work is delivered through BugXHunter, our security testing practice, for organisations across Australia.
Open roleHiring
Tell us where you are based and the arrangement you are after.
The role
What you will do.
Scoped engagements, from a single web application to a full red team exercise.
Test
Attack by hand
Web applications, APIs, networks and cloud environments, tested the way a real intruder would, well past what a scanner reports.
AI
Go after AI systems
Prompt injection, data leakage and agent misuse in the AI our clients have built, aligned to the OWASP LLM Top 10.
Red team
Run realistic attacks
An operation against a goal the client chooses, to measure how well their people and tools detect and respond.
Report
Write findings people act on
Each finding triaged, rated, and written up with the evidence and the fix, for engineers, auditors and boards.
Retest
Prove it is closed
A finding is closed when you can no longer get in, not when a ticket says so.
Scope
Stay inside the lines
Clients agree a scope, a timeline and a fixed price up front. You know what is in and what is out before you start.
What we look for
A certification that says you have done it for real.
One of these, or something comparable that was earned at a keyboard.
OffSec
OSCP
Offensive Security Certified Professional.
GIAC
GPEN
GIAC Penetration Tester.
CREST
Registered Tester
CREST Registered Penetration Tester (CRT).
Or similar
Show us
A comparable practical certification, or public work that proves the same thing.
How we work
People lead. The tooling keeps up.
Every engagement is led by a tester. The flaws that matter are found by someone thinking about how the business actually works, and that is the job we are hiring for.
Beside you, open-weight models hosted in Australia by SCX.ai do the reading and cross-referencing, so what you learn about a client's weaknesses stays onshore. More on that on the security testing page.
Beyond the certificate, we want to see that you write clearly, that you are careful with a client's systems and data, and that you stay inside the scope you were given.
The BugXHunter Runner is open source under the MIT licence. You can read it at bugxhunter.com before you apply.
Apply
Tell us what you have broken.
Tell us where you are based and the kind of arrangement you are after. A link to your CV or LinkedIn profile is enough; write-ups, CVEs and bug bounty profiles are welcome.
- Email[email protected]
- Practicebugxhunter.com/careers
- PleaseNo client names or past findings