Senior Penetration Tester

• Conduct manual penetration tests across applications, APIs, cloud environments, and other critical systems to identify and validate security vulnerabilities.
• Develop AI-assisted security tools and automation to expand testing coverage, improve efficiency, and support the security team's day-to-day work.
• Design and implement testing strategies for AI-powered applications, LLMs, autonomous agents, and AI-generated code, incorporating effective approaches into recurring security assessments.
• Review findings from Static Application Security Testing (SAST) tools, remediate confirmed vulnerabilities, and refine detection rules to reduce false positives.
• Perform secure code reviews across web applications, APIs, and AWS infrastructure, ensuring security risks are identified early in development.
• Build security tools and services within the application stack, including AI-enabled solutions that streamline security workflows.
• Support security reviews before production releases, ensuring AI-generated and AI-assisted code receives appropriate assessment before deployment.
• Collaborate with software engineers and security stakeholders to explain vulnerabilities, communicate business and technical risks, and prioritize effective remediation.
• Contribute to the evolution of application security practices, testing methodologies, and secure software development processes as the organization scales its use of AI.

Requirements

• At least 5 years of professional experience in application security, offensive security, penetration testing, or product security.
• Demonstrated hands-on expertise in penetration testing and secure code review across web applications, APIs, and cloud infrastructure, particularly AWS.
• Strong analytical and investigative skills, with a curious, adversarial mindset and the ability to uncover vulnerabilities beyond those identified by automated scanners.
• Understanding of AI and LLM security risks, including prompt injection, insecure agent tool usage, and vulnerabilities introduced through AI-generated code.
• Experience with modern programming languages such as Ruby, Python, TypeScript, or Go, along with knowledge of secure software development lifecycle (SSDLC) practices.
• Familiarity with AI tools and a willingness to apply them to security testing, automation, and workflow optimization.
• Strong communication skills, including the ability to explain technical findings, assess risk, and recommend remediation priorities to engineers and security teams.
• A bachelor's degree in Computer Science or a related technical discipline, or equivalent practical industry experience.

Nice to have:

• Experience penetration testing or red-teaming LLM applications and agentic systems.
• Offensive security certifications such as OSCP, OSWE, or equivalent qualifications.
• Experience contributing to bug bounty programs or external security testing initiatives.
• Previous experience in fintech, financial services, or other regulated industries.

Benefits

• Competitive salary: CAD $143,000–$183,000 per year, depending on qualifications, experience, skills, and internal equity.
• Annual performance bonus: Target bonus of 10%.
• Comprehensive healthcare: Medical, dental, and vision coverage.
• Retirement savings: RRSP matching program.
• Flexible time off: A flexible paid time-off policy to support work-life balance.
• Paid parental leave: Support for employees and their families.
• Remote-first flexibility: Work remotely, with the option to use office locations for in-person collaboration.
• Flexible working arrangements: Flexibility in choosing where and when to work.
• Professional development: Annual budget to support continued learning and career growth.
• Wellness reimbursement: Financial support for eligible wellness-related expenses.
• Community engagement: Paid volunteering opportunities and a charitable donation matching program.
• Collaborative culture: Opportunities to connect with colleagues through virtual and in-person activities, team celebrations, and collaborative events.
• Meaningful impact: Help strengthen the security of technology that expands access to financing for small businesses.
• Career ownership: Influence security strategy, introduce innovative testing approaches, and help establish best practices within a growing security function.