NHMRC Penetration Testing

Canberra, Australia Posted on 07/07/2026

• State/Province Australian Capital Territory
• Country Australia

Job Description

Indigitise is seeking an experienced Penetration Testing Specialist to support the National Health and Medical Research Council (NHMRC) in conducting a targeted penetration testing exercise across its external infrastructure, cloud environment, network and Wi Fi.

The engagement will assess the effectiveness of existing cyber controls, identify vulnerabilities and test the organisation's resilience against realistic external attack scenarios.

Key responsibilities:

• Identify and map the external attack surface.
• Conduct external infrastructure and asset discovery.
• Perform grey box penetration testing.
• Assess internet facing firewalls and network infrastructure.
• Test Azure cloud tenancies and Microsoft 365 exposure.
• Assess Wi Fi security from an adjacent attacker perspective onsite.
• Assess the potential compromise of a standard Azure Virtual Desktop session or Microsoft 365 credentials.
• Identify vulnerabilities, attack paths and control weaknesses.
• Provide clear findings and remediation recommendations.

Technology environment: Azure, Microsoft 365, Zscaler, Aruba Central and Azure Virtual Desktop (VDI).

Out of scope: Social engineering and third party systems.

• Strong experience delivering penetration testing and ethical hacking engagements.
• Experience assessing external facing infrastructure, firewalls and networks.
• Strong Azure cloud security and penetration testing capability.
• Experience assessing Microsoft 365 environments.
• Experience conducting Wi Fi and network penetration testing.
• Ability to test lateral movement and credential compromise scenarios.
• Experience with attack surface discovery and grey box testing.
• Ability to clearly document vulnerabilities, risks and remediation recommendations.
• Availability to work onsite in the ACT during business hours.
• Strong overall value for money and suitability for the engagement.