Lead Penetration Test Engineer

What you'll do

• Conduct comprehensive penetration testing of web applications, infrastructure, and cloud environments using manual and automated techniques.
• Develop custom scripts and tools to automate security testing within CI/CD pipelines.
• Apply cloud-specific offensive techniques including IAM abuse, container exploitation, and misconfiguration testing.
• Perform detailed security assessments using DAST, SAST, and SCA tools to validate security controls.
• Lead attack simulations and tabletop exercises to validate security controls and improve organizational response.
• Research emerging threats and adversarial techniques to inform offensive and defensive security strategies.
• Present penetration testing findings and actionable remediation guidance to both technical and non-technical stakeholders.

What we're looking for

• Minimum 8 years of experience in information security focusing on penetration testing, application security, and vulnerability management.
• Hands-on experience with tools like Burp Suite, Nessus, Metasploit, and Nmap using OWASP, MITRE ATT&CK, and PTES methodologies.
• Expertise in identifying and exploiting infrastructure and web application vulnerabilities such as XSS, SQL Injection, and IDOR.
• Proficiency in scripting or programming languages including Bash, Python, Go, PowerShell, or JavaScript.
• Experience performing DAST, SAST, and SCA assessments and integrating security testing into CI/CD pipelines.
• At least one recognized offensive security certification such as OSCP, OSCE3, OSEP, GXPN, GPEN, or CREST CRT/CCT.
• Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent experience.
• Indefinite right to work in the US or Canada.