Job Description

You’re a penetration tester who’s got the foundations down.

You’ve spent the last couple of years getting hands-on with web applications and infrastructure. You understand how to approach a test, where to look, how to think like an attacker, and how to turn that into a clear, useful report.

You might have your OSCP already. Or something equivalent.

But you’ve probably realised something.

The real challenge now isn’t just getting better at the same tests. It’s getting exposure to the things you haven’t had access to yet.

That’s where this role is different.

At your core, you’ll continue to build depth in what matters. Web applications, infrastructure, APIs, the fundamentals of good penetration testing. You’ll be working on real client engagements, developing your methodology, improving your reporting, and learning how to communicate findings in a way that actually lands.

But you won’t be limited to that.

You’ll be part of a wider APAC penetration testing community, connected to over 1,400 testers globally. That means visibility into what others are working on, from IoT and SCADA environments to large-scale automotive systems, and the chance to get involved as your skills grow.

And when you’re ready to go deeper, there are real pathways.

People here have moved into red teaming, spent time working on adversary simulations, or explored blue team environments to round out their skill sets. Some have gone on to architecture roles. Not because they were expected to know everything upfront, but because they were given the space and support to learn.

It’s less of a traditional team, more of a community. People share knowledge, support each other, and actively help you get better.

So if you’ve got the foundations in penetration testing, and you’re looking for a place where you can build on them, not just repeat them, this is where you start to accelerate.

Russell@theonset.com.au / 0438984265