Penetration Tester

About this opportunity

Ko wai mātou – About us   
Kia ora.  We’re Foodies.  You know New World, PAK’nSAVE and Four Square right? That’s us!
With 300+ stores and over 27,000 Foodies across Te Ika-a-Maui, our North Island Co-op has the privilege of helping New Zealanders get more out of life.  Locally owned, we reflect the communities we serve, and we celebrate our people - our taonga, every day for being uniquely them. 

Our Support Centre is 1,500+ people strong, which includes 500+ IT employees, who all play a vital role in ensuring the cogs of our Co-op stay turning and our systems stay ‘byte’-sized and ‘bug’-free.”. 
Te Tūranga – About the role   
At Foodstuffs North Island, security is critical to keeping our business, stores, systems and the communities we serve safe and running.
We're looking for a hands-on Red Team / Penetration Tester to help us identify weaknesses in our technology and security controls before real attackers have the chance to exploit them.
This is an opportunity to put your offensive security skills to work across a large and complex technology environment, covering corporate systems, retail and store environments, applications, networks and cloud platforms.
You'll plan and carry out penetration tests, red-team engagements and adversary simulations, looking at our environment through the eyes of an attacker. Just as importantly, you'll work alongside our Security Engineering, Operations and Technology teams to turn what you find into practical improvements and stronger security controls.
If you enjoy solving complex technical challenges, keeping up with how attackers operate and testing how well organisations defend themselves, this could be a great opportunity.
What you’ll do
Penetration Testing: Plan and carry out penetration tests across networks, infrastructure, web and mobile applications, APIs, wireless, cloud platforms (Azure, AWS and GCP), Active Directory and retail/store environments.
Red Teaming & Adversary Simulation: Plan and execute red-team exercises that replicate real-world attack techniques, testing how far an attacker could get and whether our security controls can detect and stop them.
Purple Teaming: Work alongside security and operations teams to test detection and response capabilities, identify gaps and help improve how we detect and respond to threats.
Security Control Testing: Identify vulnerabilities, misconfigurations and weaknesses across our technology environment, using a range of offensive security tools, scripts and techniques.
Reporting & Remediation: Document findings clearly, explain the risks and recommend practical ways to address them. Work with technical teams to prioritise fixes and retest to make sure the issues have been resolved.
Security Advice: Provide input into technology changes and projects, helping teams identify potential security risks early and make better security decisions.
Continuous Improvement: Keep up with new attack methods, security research and offensive security tools, sharing your knowledge and helping build capability across the wider security team.
Ngā painga - What we offer 
We’re committed to providing awesome experiences for our people, including offering a range of benefits
Inhouse learning and development programmes and courses, flu vaccinations, and social network groups (we call them Tribes).
Flexible working options, a day off on your birthday, long service leave
Free carparking - we’ve got over 1,000 carparks including EV plugs
Onsite café with subsidised meals, mini mart, 5% discount at our retail stores

He kōrero mōu - About you     
Around 4–7 years working in cyber security, with a strong focus on penetration testing and offensive security.
Hands-on experience testing a range of environments, including infrastructure, networks, applications, APIs, cloud platforms, Active Directory and identity systems.
Experience conducting red-team exercises, adversary simulations and purple-team activities, using real-world attacker techniques to test security controls.
Good knowledge of attacker methods and frameworks such as MITRE ATT&CK, with the ability to apply them in practical testing scenarios.
Strong scripting skills in languages such as Python, PowerShell, Bash or C#, and experience using offensive security tools and frameworks.
An understanding of cloud, network, application and identity security, along with the ability to identify and explain technical vulnerabilities and their potential business impact.
The ability to work through complex technical problems, investigate findings and recommend solutions that make a real difference.
Clear communication skills, with the ability to explain technical findings and risks to both technical teams and business stakeholders.
A high level of integrity and professionalism, particularly when working with sensitive information and conducting authorised security testing.
Offensive security certifications such as OSCP/OSCP+, OSEP, OSWE, CRTP, CRTO, GPEN or CREST qualifications would be an advantage, but practical experience and technical capability are what matter most.
Experience awesome. Achieve awesome. Be awesomely you.
We’re proud to have a focus on Diversity & Inclusion here at Foodies and welcome courageous behaviour, encourage togetherness, inspire our people to be their best selves in our Foodies whānau.

We encourage you to apply with all your awesomeness and welcome your diverse background, including any disability, additional health and mental health needs, and/or neurodiversity.

If you require accessibility support to ensure you can fairly access our recruitment process, please reach out to  Recruitment.Foodstuffs@foodstuffs.co.nz.  Accessibility support could include, interview location, sign language interpreter, assistive technology.

Don’t ‘cart’ around – apply now!
Are you ready to be part of our bunch – apply now!

Source: Foodstuffs on Lever. Feed checked: 16 Nov 2026.

Applications are handled by the employer or recruitment agency. Check the original advert for duties, pay, hours, requirements and availability.