Senior Penetration Tester

Accountabilities • Conduct manual penetration tests across applications, APIs, cloud environments, and other critical systems to identify and validate security vulnerabilities.

• Develop AI-assisted security tools and automation to expand testing coverage, improve efficiency, and support the security team's day-to-day work.

• Design and implement testing strategies for AI-powered applications, LLMs, autonomous agents, and AI-generated code, incorporating effective approaches into recurring security assessments.

• Review findings from Static Application Security Testing (SAST) tools, remediate confirmed vulnerabilities, and refine detection rules to reduce false positives.

• Perform secure code reviews across web applications, APIs, and AWS infrastructure, ensuring security risks are identified early in development.

• Build security tools and services within the application stack, including AI-enabled solutions that streamline security workflows.

• Support security reviews before production releases, ensuring AI-generated and AI-assisted code receives appropriate assessment before deployment.

• Collaborate with software engineers and security stakeholders to explain vulnerabilities, communicate business and technical risks, and prioritize effective remediation.

• Contribute to the evolution of application security practices, testing methodologies, and secure software development processes as the organization scales its use of AI.

Requirements

• At least 5 years of professional experience in application security, offensive security, penetration testing, or product security.

• Demonstrated hands-on expertise in penetration testing and secure code review across web applications, APIs, and cloud infrastructure, particularly AWS.

• Strong analytical and investigative skills, with a curious, adversarial mindset and the ability to uncover vulnerabilities beyond those identified by automated scanners.

• Understanding of AI and LLM security risks, including prompt injection, insecure agent tool usage, and vulnerabilities introduced through AI-generated code.

• Experience with modern programming languages such as Ruby, Python, TypeScript, or Go, along with knowledge of secure software development lifecycle (SSDLC) practices.

• Familiarity with AI tools and a willingness to apply them to security testing, automation, and workflow optimization.

• Strong communication skills, including the ability to explain technical findings, assess risk, and recommend remediation priorities to engineers and security teams.

• A bachelor's degree in Computer Science or a related technical discipline, or equivalent practical industry experience.

Nice to have:

• Experience penetration testing or red-teaming LLM applications and agentic systems.

• Offensive security certifications such as OSCP, OSWE, or equivalent qualifications.

• Experience contributing to bug bounty programs or external security testing initiatives.

• Previous experience in fintech, financial services, or other regulated industries.

Benefits

• Competitive salary: CAD $143,000–$183,000 per year, depending on qualifications, experience, skills, and internal equity.

• Annual performance bonus: Target bonus of 10%.

• Comprehensive healthcare: Medical, dental, and vision coverage.

• Retirement savings: RRSP matching program.

• Flexible time off: A flexible paid time-off policy to support work-life balance.

• Paid parental leave: Support for employees and their families.

• Remote-first flexibility: Work remotely, with the option to use office locations for in-person collaboration.

• Flexible working arrangements: Flexibility in choosing where and when to work.

• Professional development: Annual budget to support continued learning and career growth.

• Wellness reimbursement: Financial support for eligible wellness-related expenses.

• Community engagement: Paid volunteering opportunities and a charitable donation matching program.

• Collaborative culture: Opportunities to connect with colleagues through virtual and in-person activities, team celebrations, and collaborative events.

• Meaningful impact: Help strengthen the security of technology that expands access to financing for small businesses.

• Career ownership: Influence security strategy, introduce innovative testing approaches, and help establish best practices within a growing security function.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best!  Why Apply Through Jobgether?    Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.     #LI-CL1