Senior Penetration Tester

This is a fully remote position, open to applicants in Canada.

📋 Description

• Execute manual penetration tests on the company's systems.

• Develop tooling and automation for penetration testing with AI assistance.

• Establish and implement testing methodologies for LLM applications, agents, and code generated by agents.

• Assess SAST findings, address legitimate vulnerabilities, and refine rules for false positives.

• Conduct secure code evaluations for web applications, APIs, and AWS infrastructure.

• Create security tools and services within the Forward application framework.

• Assist in test-to-production reviews to ensure AI-generated work undergoes security evaluations before deployment.

• Articulate security risks and priorities to engineering teams.

• Influence the development of standards, tools, and practices for the expanding security program.

⛳️ Requirements

• Minimum of 5 years experience in application security, offensive security, or product security.

• Practical experience in penetration testing and code reviews for web applications, APIs, and AWS cloud environments.

• A strong curiosity about system vulnerabilities and persistence even after scanners indicate clean results.

• Interest in leveraging AI to address challenges in personal workflows or systems being evaluated.

• Knowledge of AI/LLM attack vectors, such as prompt injection, insecure tool utilization by agents, and vulnerabilities typical of AI-generated code.

• Proficiency in Ruby, Python, TypeScript, or Go.

• Familiarity with secure SDLC practices.

• Capability to communicate risks and prioritize tasks for security and software engineering teams.

• Bachelor's Degree in Computer Science or a related technical field, or equivalent industry experience.

• Candidates must possess authorization to work for any employer in Canada.

• OSCP/OSWE or similar offensive certifications (preferred).

• Experience in pentesting or red-teaming LLM applications and agentic systems (preferred).

• Participation in bug-bounty or external testing initiatives (preferred).

• Experience in fintech or other regulated sectors (preferred).

🏝️ Benefits

• Flexible work arrangements: work remotely, on-site, or a mix of both.

• Flexible working hours.

• Medical insurance coverage.

• Dental insurance coverage.

• Vision insurance coverage.

• Flexible time-off policy.

• Paid parental leave.

• RRSP matching program.

• Wellness reimbursement.

• Volunteering days.

• Annual budget for professional development.

• Charitable donation matching.

• Virtual and in-person team events.

• 10% annual target bonus.