Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 74 days ago

Offensive Security Engineer

My NRMA127 open roles

Where
Sydney Olympic Park, NSW, Australia
Work mode
Hybrid
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowOffensive Security EngineerMy NRMA · Sydney Olympic Park, NSW, Australia

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on My NRMA's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.9% of postings close within 7 days. Measured by our own scanner across the market. My NRMA postings stay open a median of 19 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 12.9%7 days
  4. 21.0%14 days
  5. 35.6%30 days
  6. 58.5%60 days
This job: posted 74 days ago

My NRMA median: 19 days open

The posting

Company Description

We’re one of Australia’s most trusted brands. Being Member-owned, every decision we make has people and our community at its heart. From our legendary Roadside assistance to electric vehicle charging networks, holiday parks and lodges, car rentals, harbour transport, and ocean cruising we are striving to make a difference that contributes to a brighter shared future for all Australians.

Forget what you thought you knew about the NRMA – take a look on the inside and you’ll discover that life with us is more than just a job – it’s your chance to make a difference together.

Job Description

We have an exciting opportunity for an Offensive Security Engineer to join our Technology team based in Sydney Olympic Park. This role plays an important part in protecting the confidentiality, integrity, availability and resilience of NRMA technology and data by identifying exploitable weaknesses before they cause harm, validating the effectiveness of security controls, and supporting safer delivery across our technology environment.

Reporting to the Senior Manager, Security Compliance & Governance, you’ll work closely with engineering, cloud, platform, infrastructure, architecture and security teams to embed security early in the software development lifecycle, reduce vulnerabilities reaching production, and provide evidence-based assurance across applications, APIs, cloud environments and security controls.

This is a hands-on role for someone who enjoys practical security testing, automation, threat emulation, vulnerability lifecycle management and working with technical teams to improve security outcomes in a complex enterprise environment.

This 9-12 month maximum term contract role offers a hybrid work arrangement across our Sydney Olympic Park, Sydney CBD offices and working from home, as agreed and required for the role.

What You’ll Do

  • Plan and perform authorised, risk-based security testing across web applications, APIs, infrastructure, networks, identity services and cloud-hosted workloads.
  • Operate, administer and optimise security testing platforms, including SAST, DAST, CSPM and attack simulation tooling.
  • Embed security testing early in the software development lifecycle and support secure development practices across engineering teams.
  • Integrate application security, dependency, open-source risk, DAST and API security testing controls into code repositories, IDEs and CI/CD pipelines.
  • Conduct authorised penetration testing, technical security assessments, security design reviews and threat modelling for material changes.
  • Validate, triage and document security findings, including severity, business impact, accountable owners, target remediation dates and closure evidence.
  • Track remediation progress, retest resolved vulnerabilities and escalate overdue or material findings where required.
  • Use cloud security posture management tooling to assess cloud vulnerabilities, misconfigurations, attack paths and compliance posture.
  • Conduct MITRE ATT&CK-aligned control validation, adversary emulation and purple team activities across key security controls.
  • Provide practical remediation advice to engineering and technology teams, including guidance aligned to OWASP Top 10, PCI DSS secure coding requirements and secure AI development practices.
  • Automate repeatable discovery, testing, ticketing, evidence collection, reporting, remediation tracking and validation activities where practical.
  • Produce evidence-based reports, service metrics and control-effectiveness insights to support operational, executive, audit and governance reporting.

What You’ll Bring

  • Experience in cybersecurity, application security, penetration testing, security engineering or DevSecOps.
  • Strong knowledge of web application, API and cloud security.
  • Hands-on experience with security testing tools such as SAST, DAST and CSPM platforms.
  • Understanding of secure software development and CI/CD environments.
  • Experience identifying, validating and remediating security vulnerabilities.
  • Knowledge of security frameworks including OWASP Top 10, MITRE ATT&CK, ISO 27001, NIST and PCI DSS.
  • Ability to automate tasks using scripting languages such as Python or PowerShell.
  • Strong analytical and problem-solving capabilities.
  • Excellent stakeholder engagement and communication skills.
  • Ability to provide practical, risk-based security advice to technical and business teams.
  • Relevant cybersecurity qualifications, certifications or equivalent industry experience.
  • A passion for emerging security technologies, automation and continuous improvement.

What's in it for you?

At the NRMA we aren’t just about discounts (although you do get these too). We offer benefits to help make work and life just right for you!

  • Progressive flexibility, leave and well-being benefits to balance all of life's priorities
  • Travel discounts on SIXT car rental, cruises, and accommodation at our award-winning NRMA Holiday Parks and Resorts
  • Complimentary myNRMA Rewards membership including free Roadside Assistance & discounts on groceries, movie tickets, gift cards, gym memberships, attractions, restaurants and much more
  • Discounts on a range of NRMA personal insurance products including car, home & travel
  • Grow, progress or relocate your career and move around the NRMA Group or different locations with us.

Know you belong

We’re for inclusion, diversity and representing the members, guests, customers and communities we serve. That’s why we welcome applications from First Nations, people with disability, those from diverse cultural backgrounds, people of all genders, members of the LGBTQI+ community, and anyone else who wants to be a part of our team.

Join the NRMA and grow your career with us. Apply now, we cannot wait to hear from you or visit our careers site to find out more!

Our Talent Acquisition Team and Hiring Leaders kindly request no unsolicited resumes or approaches from Recruitment Agencies. The NRMA is not responsible for any fees related to unsolicited resumes.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against My NRMA's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on My NRMA's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    My NRMA's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.