Senior Penetration Tester

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Penetration Tester based in Canada.

Join a forward-thinking fintech environment where cybersecurity plays a critical role in protecting applications, infrastructure, and sensitive financial data. As a Senior Penetration Tester, you will identify vulnerabilities across web applications, APIs, cloud infrastructure, and emerging AI-powered systems before they can be exploited. You will combine hands-on penetration testing with secure code reviews and automated security tooling to strengthen application security across the software development lifecycle. Working closely with engineering and security teams, you will help translate complex technical findings into actionable improvements. You will also shape innovative approaches to testing large language models (LLMs), AI agents, and AI-generated code. This remote-first opportunity offers significant ownership, technical influence, and the chance to help build security practices in a rapidly evolving, AI-driven organization.

Accountabilities

Conduct manual penetration tests across applications, APIs, cloud environments, and other critical systems to identify and validate security vulnerabilities.
Develop AI-assisted security tools and automation to expand testing coverage, improve efficiency, and support the security team's day-to-day work.
Design and implement testing strategies for AI-powered applications, LLMs, autonomous agents, and AI-generated code, incorporating effective approaches into recurring security assessments.
Review findings from Static Application Security Testing (SAST) tools, remediate confirmed vulnerabilities, and refine detection rules to reduce false positives.
Perform secure code reviews across web applications, APIs, and AWS infrastructure, ensuring security risks are identified early in development.
Build security tools and services within the application stack, including AI-enabled solutions that streamline security workflows.
Support security reviews before production releases, ensuring AI-generated and AI-assisted code receives appropriate assessment before deployment.
Collaborate with software engineers and security stakeholders to explain vulnerabilities, communicate business and technical risks, and prioritize effective remediation.
Contribute to the evolution of application security practices, testing methodologies, and secure software development processes as the organization scales its use of AI.
Requirements
At least 5 years of professional experience in application security, offensive security, penetration testing, or product security.
Demonstrated hands-on expertise in penetration testing and secure code review across web applications, APIs, and cloud infrastructure, particularly AWS.
Strong analytical and investigative skills, with a curious, adversarial mindset and the ability to uncover vulnerabilities beyond those identified by automated scanners.
Understanding of AI and LLM security risks, including prompt injection, insecure agent tool usage, and vulnerabilities introduced through AI-generated code.
Experience with modern programming languages such as Ruby, Python, TypeScript, or Go, along with knowledge of secure software development lifecycle (SSDLC) practices.
Familiarity with AI tools and a willingness to apply them to security testing, automation, and workflow optimization.
Strong communication skills, including the ability to explain technical findings, assess risk, and recommend remediation priorities to engineers and security teams.
A bachelor's degree in Computer Science or a related technical discipline, or equivalent practical industry experience.
Nice to have:
Experience penetration testing or red-teaming LLM applications and agentic systems.
Offensive security certifications such as OSCP, OSWE, or equivalent qualifications.
Experience contributing to bug bounty programs or external security testing initiatives.
Previous experience in fintech, financial services, or other regulated industries.
Benefits
Competitive salary: CAD $143,000–$183,000 per year, depending on qualifications, experience, skills, and internal equity.
Annual performance bonus: Target bonus of 10%.
Comprehensive healthcare: Medical, dental, and vision coverage.
Retirement savings: RRSP matching program.
Flexible time off: A flexible paid time-off policy to support work-life balance.
Paid parental leave: Support for employees and their families.
Remote-first flexibility: Work remotely, with the option to use office locations for in-person collaboration.
Flexible working arrangements: Flexibility in choosing where and when to work.
Professional development: Annual budget to support continued learning and career growth.
Wellness reimbursement: Financial support for eligible wellness-related expenses.
Community engagement: Paid volunteering opportunities and a charitable donation matching program.
Collaborative culture: Opportunities to connect with colleagues through virtual and in-person activities, team celebrations, and collaborative events.
Meaningful impact: Help strengthen the security of technology that expands access to financing for small businesses.
Career ownership: Influence security strategy, introduce innovative testing approaches, and help establish best practices within a growing security function.