Penetration Tester

• Lead and support penetration testing across Health New Zealand's complex technology environment.

• Use offensive security expertise to identify vulnerabilities and strengthen healthcare security.

• Join the Security Assurance team | Location flexible within New Zealand.

Health New Zealand | Te Whatu Ora is the country's largest employer, delivering universal public healthcare to more than five million New Zealanders.

We provide essential hospital, specialist and community health services across 80+ locations, from large urban centres to rural towns and remote communities.

Our goal is to improve health outcomes for all New Zealanders by delivering equitable, accessible and innovative care.

About the Role

As a Penetration Tester, you'll help identify and assess security weaknesses across one of New Zealand's largest and most complex technology environments.

Working within the Security Assurance team, you'll lead and support penetration testing engagements across a range of environments, including on-premises infrastructure, cloud platforms, web applications and medical devices.

You'll manage engagements from scoping and planning through to testing, exploitation, analysis and reporting. Using advanced techniques, you'll simulate real-world threat actor behaviour to understand how vulnerabilities could be exploited and the risks they present.

Beyond identifying vulnerabilities, you'll assess their significance and provide clear, actionable reports and remediation advice to technical and non-technical stakeholders.

You'll also contribute to the ongoing development of the Penetration Testing Programme by improving methodologies, tools, automation and ways of working. As an experienced practitioner, you'll share knowledge and mentor others to help strengthen offensive security capability across the team.

Patient safety is central to our work. All testing must be appropriately scoped, authorised and conducted within established security frameworks and approval processes.

In this role, you will:

• Lead and support penetration testing engagements from scoping through to reporting and remediation advice.

• Conduct advanced exploitation and vulnerability analysis across networks, applications and cloud environments.

• Perform web application, infrastructure and cloud penetration testing.

• Assess medical devices and other specialised technology environments where required.

• Conduct source code security reviews and evaluate vulnerability exploitability and impact.

• Simulate real-world threat actor techniques to identify exploitable weaknesses.

• Produce clear reports with prioritised findings and remediation recommendations.

• Provide technical security advice to system owners, architects and project teams.

• Conduct technical security compliance assessments against relevant requirements.

• Assess systems against Secure-by-Design standards, Health Information Security Framework (HISF) requirements and the Cyber Control Catalogue.

• Improve penetration testing methodologies, tools, scripts and automation.

• Keep up to date with emerging threats, attack techniques and offensive security tools.

• Mentor team members and share specialist knowledge to build capability.

• Support the National Security Technical Assurance Manager with programme maturity, service quality and engagement processes.

About the Team / Service / Location

You'll join the Security Assurance team, working alongside penetration testers and security specialists to provide technical assurance across Health New Zealand.

The team works closely with the National Security Operations Centre, other security teams, Digital and Data project teams, platform and architecture teams, system owners and technical specialists.

You'll also engage with government agencies, health sector partners, vendors, security researchers and external security communities to help Health New Zealand understand and respond to an evolving threat landscape.

Our technology environment is broad and complex, offering opportunities to tackle varied challenges and contribute to the ongoing development of our penetration testing capability.

About You

You're an experienced penetration tester with a naturally curious mindset and the technical depth to investigate, validate and exploit vulnerabilities beyond automated scanning.

You enjoy taking ownership of complex engagements, making sound technical decisions and understanding the real-world impact of security weaknesses.

You're also a confident communicator who can translate complex technical findings into practical risk and remediation advice for a range of stakeholders.

As an experienced practitioner, you'll enjoy mentoring others, sharing knowledge and contributing to the development of the wider team. You understand the importance of integrity, careful planning and authorised testing, particularly within a healthcare environment where patient safety comes first.

You will bring:

• A Bachelor's degree in Computer Science, Cyber Security or a related discipline, or equivalent professional experience.

• A recognised penetration testing certification such as OSCP, GPEN or CRTO.

• At least 5 years' experience in penetration testing and vulnerability assessments within complex enterprise environments.

• Demonstrated experience in web application, network infrastructure and cloud penetration testing.

• Strong programming and scripting skills using languages such as Python, PowerShell, Java or C/C++.

• Comprehensive knowledge of cybersecurity principles, threat modelling, exploitation techniques and current attack methodologies.

• Ability to independently plan and conduct advanced penetration testing across diverse technology environments.

• Experience analysing findings and producing actionable reports for technical and non-technical audiences.

• Strong understanding of current threats, adversary techniques and offensive security tools.

• Experience mentoring others and sharing specialist technical knowledge.

• Strong communication, relationship-building and problem-solving skills.

• A strong sense of accountability and responsibility for delivering outcomes.

• Eligibility to obtain and maintain an appropriate New Zealand Government security clearance.

It would be advantageous if you also have:

• Additional offensive security certifications such as OSWE, OSEP or GWAPT.

• Experience in healthcare, critical national infrastructure or other regulated environments.

• Experience with medical device or operational technology security testing.

• Experience assessing systems against frameworks such as NZISM or HISF.

• Experience with red team or adversary simulation techniques.

• Experience implementing Te Tiriti o Waitangi in action.

Working for Health New Zealand

Health New Zealand | Te Whatu Ora is committed to delivering excellent healthcare for all New Zealanders. We embrace diversity and inclusion so that our workforce reflects the communities we serve. We welcome applications from our diverse Māori, Pacific, disabled and rainbow communities.

We're also committed to creating an environment where people can bring their ideas, challenge the way things are done and continuously improve how we work.

How to Apply

To apply, please click Apply now. All applications must be submitted through our online careers portal by 11:59pm on Thursday, 26 November 2026.

For any questions about the role, please contact Ash Mohan at ash.mohan@tewhatuora.govt.nz.