Security Testing Lead Specialist

XPT Software Australia Pty Ltd Contract

Security Testing Lead Specialist

Melbourne, Sydney, Brisbane, Canberra, Adelide, Perth, Australia Posted on 08/14/2026

• State/Province Victoria
• Country Australia

About Us

AboutXPT

• XPT SoftwareAustralia PTY Ltd, incorporated in 2016, is a Software Services company
• XPT works with topclients across Australia in Banking, Insurance, Telecom,Retail, Energy, Mining and Manufacturingdomains.
• We have 120+technocrats in Australia working at our clientlocations.
• XPT SoftwareAustralia is part of group companies which has globalpresence across India & Europe.
• We have served100+ clients globally, fulfilling their onsite-offshoreneeds.

Job Description

Security Testing Lead Specialist

Key Accountabilities Include

• Lead and deliverhigh-complexity, high-assurance security assessments across systems, includingadvanced penetration testing, vulnerability assessments, and source codesecurity reviews, focusing on real-world exploitability and attack pathdevelopment.
• Provide authoritative technicalleadership as a subject matter expert in security testing and securedevelopment, acting as the primary escalation point for complexvulnerabilities, assessments, and adversary emulation activities.
• Evaluate the effectiveness ofsystems in protecting organisational data and maintaining intendedfunctionality, and provide strategic recommendations to improve securityposture and resilience.
• Identify and validate criticalvulnerabilities, exploit paths, and attack vectors, including analysing scanoutputs and manual testing results to assess risk and impact accurately.
• Translate technical findingsinto clear, actionable business risk insights, supporting informed decisionmaking and prioritised remediation.
• Drive the evolution of securitytesting strategy, methodologies, and standards, ensuring alignment withindustry best practices and continuous improvement across the function.
• Collaborate with the SecurityTesting - Senior Lead and broader cyber security teams to shape capabilitydevelopment, resourcing, and operational direction.
• Assess existing securitycontrols and practices against expected standards, and recommend improvementsto address gaps and uplift security maturity.
• Ensure delivery of high-qualitysecurity assessment reports, clearly articulating risks, impacts, and recommended mitigations.
• Provide mentorship andtechnical guidance to uplift capability across both senior and junior teammembers.
• Apply a pragmatic, risk-basedapproach to all activities, balancing security requirements with businessobjectives, timelines, and operational constraints.
• Fulfil Health, Safety, andEnvironment (HSE) responsibilities in accordance with organisational policies andregulatory requirements.

Additional Information

• Provide technical leadershipacross the domain, including performing and leading complex assessments acrossmultiple technical domains, and responding to escalated incidents andengagements.
• Provide input into PenetrationTesting, Vulnerability Assessment and Secure Code processes, methodologies,standards, and corresponding roadmaps and enhancement plans.
• Develop and deliver trainingfor junior team members and the broader community to uplift security capability.
• Promote shift-left practices toenable the delivery of secure, high-quality code at speed.
• Provide guidance on applicationsecurity architecture and secure design considerations.
• Develop scripts and contributeto automation initiatives to improve the efficiency and effectiveness ofsecurity testing activities.
• Refine and define engagementprocesses, secure code artefacts, security criteria, and use cases.
• Collaborate with third parties,including vendors and newly acquired entities, to assess and uplift theirsecurity and development practices.
• Conduct quality assurancereviews of deliverables produced within the Secure Code team to ensure hightechnical standards.
• Operate effectively inenvironments with ambiguous or conflicting requirements, consistentlydelivering high-quality outcomes aligned with Cyber Security expectations.
• Translate technicalvulnerabilities into business risk for stakeholders in a timely manner,leveraging insights from the broader Cyber Security function.
• Apply a pragmatic approach tosecurity testing, balancing business objectives, standards alignment, cost,time, and risk considerations.

Qualifications / Experiences

• A minimum of 8 years'experience in a Security Testing role
• Experience and exposure to avariety of software delivery models, including DevOps and Waterfall
• Significant experience inperforming complex security assessments across a range of domain areas in alarge corporate environment
• Significant experience inimplementing automated security assessment tools into CI/CD pipelines
• Exceptional working knowledgeof Security Assessment toolsets, such as Vulnerability Scanners, Static CodeAnalysis and Software Composition Analysis tools.
• Ability to review and provideguidance and feedback on security assessment reports
• Strong understanding ofapplication security architecture principles including transport security,authentication, authorisation, threat modelling, and logging and monitoring.
• Experience in training anddeveloping people
• Tertiary qualifications inElectrical/Electronic, Computer, Network or Software Engineering;Information/Cyber Security; IT or a related discipline
• Demonstratable skillsetexceeding that expected of a person holding OSCE/OSWE or CREST - Certifiedqualifications for domain areas in scope for the position.

Highly Desirable

• Prior experience as a developer/ software engineer is a significant advantage.
• Experience in developingsecurity policy, standards, and development guidelines
• Significant experience in otherdomain areas of Cyber Security
• A strong understanding ofadjacent security dependencies including endpoints, application platforms,databases, network security technologies, development frameworks.
• Current industry certification,including but not limited to: OSCP, OSCE3, OSWE; CREST (CCT, CCSC, CCSAS,CCSAM); SANS (GPEN, GAWN, GWAPT, GXPN); (ISC)2 CISSP, CCSP
• Experience in managingengagements with external security vendors
• Demonstrable history ofdeveloping exploits and zero-day discovery