Senior Penetration Tester

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Penetration Tester based in Canada. Join a forward-thinking fintech environment where cybersecurity plays a critical role in protecting applications, infrastructure, and sensitive financial data. As a Senior Penetration Tester, you will identify vulnerabilities across web applications, APIs, cloud infrastructure, and emerging AI-powered systems before they can be exploited. You will combine hands-on penetration testing with secure code reviews and automated security tooling to strengthen application security across the software development lifecycle. Working closely with engineering and security teams, you will help translate complex technical findings into actionable improvements. You will also shape innovative approaches to testing large language models (LLMs), AI agents, and AI-generated code. This remote-first opportunity offers significant ownership, technical influence, and the chance to help build security practices in a rapidly evolving, AI-driven organization. Accountabilities - Conduct manual penetration tests across applications, APIs, cloud environments, and other critical systems to identify and validate security vulnerabilities. - Develop AI-assisted security tools and automation to expand testing coverage, improve efficiency, and support the security team's day-to-day work. - Design and implement testing strategies for AI-powered applications, LLMs, autonomous agents, and AI-generated code, incorporating effective approaches into recurring security assessments. - Review findings from Static Application Security Testing (SAST) tools, remediate confirmed vulnerabilities, and refine detection rules to reduce false positives. - Perform secure code reviews across web applications, APIs, and AWS infrastructure, ensuring security risks are identified early in development. - Build security tools and services within the application stack, including AI-enabled solutions that streamline security workflows.

- Support security reviews before production releases, ensuring AI-generated and AI-assisted code receives appropriate assessment before deployment. - Collaborate with software engineers and security stakeholders to explain vulnerabilities, communicate business and technical risks, and prioritize effective remediation. - Contribute to the evolution of application security practices, testing methodologies, and secure software development processes as the organization scales its use of AI. Requirements - At least 5 years of professional experience in application security, offensive security, penetration testing, or product security. - Demonstrated hands-on expertise in penetration testing and secure code review across web applications, APIs, and cloud infrastructure, particularly AWS. - Strong analytical and investigative skills, with a curious, adversarial mindset and the ability to uncover vulnerabilities beyond those identified by automated scanners. - Understanding of AI and LLM security risks, including prompt injection, insecure agent tool usage, and vulnerabilities introduced through AI-generated code. - Experience with modern programming languages such as Ruby, Python, TypeScript, or Go, along with knowledge of secure software development lifecycle (SSDLC) practices. - Familiarity with AI tools and a willingness to apply them to security testing, automation, and workflow optimization. - Strong communication skills, including the ability to explain technical findings, assess risk, and recommend remediation priorities to engineers and security teams. - A bachelor's degree in Computer Science or a related technical discipline, or equivalent practical industry experience. Nice to have: - Experience penetration testing or red-teaming LLM applications and agentic systems. - Offensive security certifications such as OSCP, OSWE, or equivalent qualifications.