Senior Penetration Tester

Senior Penetration Tester

Senior Penetration Tester

Lead advanced penetration testing across Health New Zealand's complex technology environment

Use offensive security expertise to identify real-world vulnerabilities and strengthen healthcare security

Join the Security Assurance team | Location flexible within New Zealand

Health New Zealand | Te Whatu Ora is the country's largest employer, delivering universal public healthcare to more than five million New Zealanders.

We provide essential hospital, specialist, and community health services across 80+ locations - from large urban centres to rural towns and remote communities.

Our goal is to improve health outcomes for all New Zealanders by delivering equitable, accessible, and innovative care.

About the Role

As a Senior Penetration Tester, you'll play a key role in identifying and understanding security weaknesses across one of New Zealand's largest and most complex technology environments.

Working within the Security Assurance team, you'll lead complex penetration testing engagements across a broad range of environments, including on-premises infrastructure, cloud platforms, web applications and medical devices.

You'll take engagements from scoping and planning through to testing, exploitation, analysis and reporting, using advanced techniques to simulate real-world threat actor behaviour and understand what could happen if vulnerabilities were exploited.

This isn't just about finding vulnerabilities. You'll need to understand their significance, assess the actual risk and explain what needs to happen next. You'll produce clear, factual and actionable reports that help both technical and non-technical stakeholders understand the issues and make informed decisions about risk treatment.

You'll also bring your expertise beyond individual engagements. You'll contribute to the evolution of the Penetration Testing Programme, improving methodologies, tooling, automation and ways of working. As a senior practitioner, you'll share your knowledge and mentor others, helping build offensive security capability across the team.

Patient safety is central to everything we do. You'll work within established security frameworks, methodologies and approval processes, ensuring testing is appropriately scoped and authorised before activity begins.

In this role, you will:

• Lead complex penetration testing engagements from scoping through to reporting and remediation advice
• Conduct advanced exploitation and vulnerability analysis across networks, applications and cloud environments
• Perform web application, infrastructure and cloud penetration testing
• Assess the security of medical devices and other specialised technology environments where required
• Conduct source code security reviews and assess the exploitability and impact of identified vulnerabilities
• Simulate real-world threat actor techniques to identify weaknesses that could be exploited
• Produce clear and actionable reports, prioritising findings and remediation recommendations
• Provide technical security advice to system owners, architects and project teams
• Conduct technical security compliance assessments against relevant security requirements
• Assess systems against Secure-by-Design standards, Health Information Security Framework (HISF) requirements and the Cyber Control Catalogue
• Contribute to the development and improvement of penetration testing methodologies, tools, scripts and automation
• Keep up to date with emerging threats, attack techniques and offensive security tooling
• Mentor and support other team members, sharing specialist knowledge and helping build team capability
• Support the National Security Technical Assurance Manager with programme maturity, service quality and engagement processes

About the Team / Service / Location

You'll join the Security Assurance team, working alongside penetration testers and security specialists to provide specialist technical assurance across Health New Zealand.

The team works closely with the National Security Operations Centre and other security teams, Digital and Data project teams, platform and architecture teams, system owners and technical staff.

You'll also connect with external security communities, government agencies, health sector partners, vendors and security researchers, helping ensure Health NZ continues to understand and respond to an evolving threat landscape.

This is a role where curiosity matters. Our environment is broad and complex, and you'll encounter technologies and challenges that require you to think beyond a standard checklist or testing methodology.

You'll have the opportunity to contribute not just through the engagements you lead, but through the way the wider penetration testing capability develops.

About You

You're an experienced penetration tester who enjoys figuring out how things work, finding where they can be broken and understanding what could happen if they were.

You're naturally curious and have the technical depth to go beyond automated scanning and surface-level findings. You know how to investigate, validate and exploit vulnerabilities, but you also understand that good penetration testing is about providing useful insight - not simply producing a long list of findings.

You're comfortable taking ownership of complex engagements. You can work through ambiguity, make sound technical decisions and know when something needs to be escalated.

You're also a strong communicator. You can explain a highly technical vulnerability to a security specialist, then translate the potential impact and remediation priorities for a non-technical stakeholder.

As a senior practitioner, you'll enjoy sharing what you know. You'll support and mentor others, contribute ideas and help lift the capability and consistency of the wider team.

You'll bring a strong sense of responsibility and integrity, particularly given the potential impact of security testing in a healthcare environment. You understand that testing must be carefully planned and authorised, and that patient safety comes first.

You will bring:

• A Bachelor's degree in Computer Science, Cyber Security or a related discipline, or equivalent professional experience
• A recognised professional penetration testing certification such as OSCP, GPEN or CRTO
• At least 5 years' experience conducting penetration testing and vulnerability assessments in complex enterprise environments
• Demonstrated experience conducting web application, network infrastructure and cloud penetration testing
• Strong programming and scripting skills relevant to security testing, such as Python, PowerShell, Java or C/C++
• Comprehensive understanding of cybersecurity principles, threat modelling, exploitation techniques and current attack methodologies
• Strong ability to independently plan and conduct advanced penetration testing across diverse technology environments
• Experience analysing findings and producing clear, actionable reports for technical and non-technical audiences
• Strong understanding of current threats, adversary techniques and offensive security tooling
• A demonstrated ability to provide technical mentoring and share specialist knowledge
• A strong drive to deliver and take personal responsibility for outcomes
• Strong communication and relationship-building skills
• Eligibility to obtain and maintain an appropriate New Zealand Government security clearance

It would be advantageous if you also have:

• Additional offensive security certifications such as OSWE, OSEP or GWAPT
• Experience working in healthcare, critical national infrastructure or other regulated environments
• Experience with medical device or operational technology security testing
• Experience conducting assessments against frameworks such as NZISM or HISF
• Experience with red team or adversary simulation techniques
• Experience implementing Te Tiriti o Waitangi in action

Working for Health New Zealand

Health New Zealand | Te Whatu Ora is committed to delivering excellent healthcare for all New Zealanders. We embrace diversity and inclusion so that our workforce reflects the communities we serve. We welcome applications from our diverse Māori, Pacific, disabled, and rainbow communities.

We're also committed to creating an environment where people can bring their ideas, challenge the way things are done and continuously improve how we work.

How to Apply

To apply, please click "Apply now."

All applications must be submitted through our online careers portal by 11:59PM 16th October 2026.

If you have any questions about the role, please contact Ash Mohan at View email address on click.appcast.io.