About This Role
This role involves helping clients secure their mission-critical applications by performing security code reviews and various security tests. It suits a security professional with experience in manual penetration testing across different platforms who can also contribute to security design and mentor junior testers.
Responsibilities
- Run manual penetration tests across web applications, APIs, mobile apps, and network infrastructure, from scoping through testing, reporting, client readout, and retest
- Produce findings that are manually confirmed and exploitable, with remediation guidance a developer can act on without a follow-up call
- Handle nuanced test cases beyond the standard checklist: business logic flaws, authorization edge cases, vulnerability chaining, and environment-specific attack paths
- Present findings directly to client engineering teams and security leads, explaining what was found, why it matters, and how to fix it
- Contribute to security design reviews and threat modeling engagements earlier in the SDLC
- Mentor junior testers on test execution and report quality
- Contribute to methodology improvements, tooling, and internal playbooks
- Develop domain depth in one or more service areas (web, network, mobile, code review) through the Domain Expertise Program
Requirements
- 2+ years of hands-on manual penetration testing, not scanner-assisted
- Demonstrated ability to run standard engagements end-to-end with minimal oversight: scope, test, report, readout, retest
- Finds that go beyond OWASP Top 10 basics, including business logic issues, complex authentication flaws, and chained vulnerabilities
- Reports that are client-ready with low rework: technically accurate, clearly written, correctly risk-rated
- Software development background in one or more of Python, .NET, Ruby, or Java
- Strong communication skills in both directions: writing that doesn't require a translator and calls where you can hold your own in front of an engineering team
- Located in Canada and eligible to work (citizen, permanent resident, or valid work visa)
Nice to have:
- OSCP, OSCP+, or GWAPT certification
- Experience across multiple service areas (web + mobile, or web + network)
- Familiarity with compliance frameworks that drive clients' security programs: SOC 2, ISO 27001, PCI DSS, HIPAA
Benefits
- Yearly profit-sharing between 5 - 12% of your base salary, based on your performance
- Monthly UberEats budget
- Annual home office stipend
- 3 weeks of vacation to start
- Company-wide holiday for the week between Christmas and the New Year
