Senior Penetration Tester

Accountabilities: Conduct manual penetration tests across applications, APIs, cloud environments, and other critical systems to identify and validate security vulnerabilities. Develop AI-assisted security tools and automation to expand testing coverage, improve efficiency, and support the security team's day-to-day work. Design and implement testing strategies for AI-powered applications, LLMs, autonomous agents, and AI-generated code, incorporating effective approaches into recurring security assessments. Review findings from Static Application Security Testing (SAST) tools, remediate confirmed vulnerabilities, and refine detection rules to reduce false positives. Perform secure code reviews across web applications, APIs, and AWS infrastructure, ensuring security risks are identified early in development. Build security tools and services within the application stack, including AI-enabled solutions that streamline security workflows. Support security reviews before production releases, ensuring AI-generated and AI-assisted code receives appropriate assessment before deployment. Collaborate with software engineers and security stakeholders to explain vulnerabilities, communicate business and technical risks, and prioritize effective remediation. Contribute to the evolution of application security practices, testing methodologies, and secure software development processes as the organization scales its use of AI. Requirements At least 5 years of professional experience in application security, offensive security, penetration testing, or product security. Demonstrated hands-on expertise in penetration testing and secure code review across web applications, APIs, and cloud infrastructure, particularly AWS. Strong analytical and investigative skills, with a curious, adversarial mindset and the ability to uncover vulnerabilities beyond those identified by automated scanners. Understanding of AI and LLM security risks, including prompt injection, insecure agent tool usage, and vulnerabilities introduced through AI-generated code. Experience with modern programming languages such as Ruby, Python, TypeScript, or Go, along with knowledge of secure software development lifecycle (SSDLC) practices. Familiarity with AI tools and a willingness to apply them to security testing, automation, and workflow optimization. Strong communication skills, including the ability to explain technical findings, assess risk, and recommend remediation priorities to engineers and security teams. A bachelor's degree in Computer Science or a related technical discipline, or equivalent practical industry experience. Nice to have: Experience penetration testing or red-teaming LLM applications and agentic systems. Offensive security certifications such as OSCP, OSWE, or equivalent qualifications. Experience contributing to bug bounty programs or external security testing initiatives. Previous experience in fintech, financial services, or other regulated industries. Benefits Competitive salary: CAD $143,000–$183,000 per year, depending on qualifications, experience, skills, and internal equity. Annual performance bonus: Target bonus of 10%. Comprehensive healthcare: Medical, dental, and vision coverage. Retirement savings: RRSP matching program. Flexible time off: A flexible paid time-off policy to support work-life balance. Paid parental leave: Support for employees and their families. Remote-first flexibility: Work remotely, with the option to use office locations for in-person collaboration. Flexible working arrangements: Flexibility in choosing where and when to work. Professional development: Annual budget to support continued learning and career growth. Wellness reimbursement: Financial support for eligible wellness-related expenses. Community engagement: Paid volunteering opportunities and a charitable donation matching program. Collaborative culture: Opportunities to connect with colleagues through virtual and in-person activities, team celebrations, and collaborative events. Meaningful impact: Help strengthen the security of technology that expands access to financing for small businesses. Career ownership: Influence security strategy, introduce innovative testing approaches, and help establish best practices within a growing security function.