Senior Information Security Consultant

The Senior Information Security Consultant (Penetration Testing) plans, leads and delivers authorised, independent and risk-based security testing across Westpac New Zealand technology services.

The role identifies and safely validates exploitable weaknesses, demonstrates credible attack paths, explains customer and business impact, and provides practical root-cause remediation guidance. The role works with engineering, service, risk and third-party stakeholders to verify remediation and improve the effectiveness, coverage and repeatability of security assurance activities.

The role contributes to the protection of customer, business and operational resilience while ensuring testing is conducted safely, ethically and within approved scope. The role also supports the evolution of testing methodologies, automation capabilities and emerging technology assessments, including cloud-native and AI-enabled services

• Demonstrated experience independently delivering penetration testing or offensive-security assessments in large enterprise environments.

• Technical depth in at least two testing domains with practical breadth across web, API, network, infrastructure, cloud, identity or mobile security testing.

• Strong understanding of secure coding principles and the ability to perform effective security-focused code reviews.

• Strong knowledge of Windows Security, Linux Security, Active Directory, Authentication and Authorisation, TCP/IP Networking, DNS, HTTP/S, and API Security

• Ability to analyse attack paths and accurately determine exploitability and business risk.

• Experience producing high-quality penetration-testing reports for both technical and non-technical audiences.

• Practical scripting and/or automation capability using Python, PowerShell, Bash or similar languages.

• Working knowledge of at least one major public cloud platform.

• Strong judgement regarding approvals, scope management, evidence handling and testing safety.

• Excellent written communication, stakeholder engagement and consulting skills.

Preferred

• Financial services or regulated industry experience.

• Kubernetes, Docker, OpenShift or container security testing.

• CI/CD pipeline and DevSecOps security testing.

• Experience assessing AI-enabled systems, agents and LLM-based applications.

• Familiarity with attack-path validation and automated penetration-testing platforms.

• Relevant professional certification or equivalent demonstrated capability, such as OSCP, OSWE, OSEP, OSCE3, CREST CRT/CCT, HTB CPTS, GXPN, GPEN, or advanced SANS offensive security certification.