Penetration Tester

About Toll Group: At Toll, we do more than just logistics - we move the businesses that move the world. Our 16,000 team members help solve any logistics, transport, or supply chain challenge-big or small. We have supported our customers for more than 130 years and today serve over 20,000 customers worldwide from 500 sites in 27 markets, with a forwarding network spanning 150 countries. We are proudly part of Japan Post.

Role Overview

Join Toll Group as a Penetration Tester and play a critical role in strengthening our cyber resilience. Reporting to the Cybersecurity Threat Prevention Manager, you will identify and assess vulnerabilities across applications, infrastructure, APIs and cloud environments, helping to protect our global business from evolving cyber threats. The position can be based in Brisbane, Sydney or Melbourne.

Responsibilities

• Conduct penetration testing across web applications, APIs, infrastructure and cloud platforms.
• Identify, validate and safely exploit vulnerabilities to assess business risk and security impact.
• Produce clear technical reports with actionable remediation recommendations.
• Collaborate with Technology, Cyber Critical Controls, Detection & Response and project teams to strengthen security posture.
• Participate in threat modelling, security reviews and attack surface assessments.
• Research emerging threats and enhance offensive security tools, processes and testing methodologies.

Qualifications

• Bachelor's or Master's degree in Computer Science, Business or a related discipline.
• Industry certifications such as OSCP, OSWE, CRTO, CRT, Security+ or equivalent are highly regarded.
• Public security research, conference presentations or technical write-ups viewed favourably.
• Ability to obtain and maintain an Australian Government Security Clearance (minimum NV2).

Skills & Experience

• 3-5 years of experience in penetration testing, offensive security or a related cyber security role.
• Demonstrated experience testing web applications, APIs, internal and external networks.
• Strong knowledge of OWASP Testing Guide, OWASP Top 10 and MITRE ATT&CK frameworks.
• Experience with tools such as Burp Suite, Nmap, Nessus, Metasploit, BloodHound and PowerShell.
• Working knowledge of Microsoft technologies, Active Directory, Entra ID and cloud platforms including Azure, AWS and/or GCP.
• Excellent analytical, investigative and stakeholder engagement skills, with the ability to communicate technical concepts clearly.

Legal and Equitable Hiring

We value a diverse, inclusive and authentic workplace. All qualified individuals are encouraged to apply. If your experience does not align perfectly, we welcome you to speak with us. We have no discriminatory practice and welcome people of all ages, ethnicities, genders and abilities.

You must be entitled to work in Australia and be prepared to undertake pre employment checks, including a criminal history check and medical examinations.