Penetration Tester
Software Secured is a leading Penetration Testing as a Service company, with a head office in beautiful Ottawa, Canada. We help software development teams get ahead of hackers using a suite of services and products.
Our team of pentesters is seeking a pentester to join us and help secure a few hundred additional applications.
As a Pentester at Software Secured , you will have the opportunity to help our clients secure their mission-critical applications. This includes performing security code review, web, mobile, and network security tests. Help clients with security design reviews, threat modelling, and remediation strategies.
What You'll Do
- Run manual penetration tests across web applications, APIs, mobile apps, and network infrastructure — from scoping through testing, reporting, client readout, and retest
- Produce findings that are manually confirmed and exploitable, with remediation guidance a developer can act on without a follow-up call
- Handle nuanced test cases beyond the standard checklist: business logic flaws, authorization edge cases, vulnerability chaining, and environment-specific attack paths
- Present findings directly to client engineering teams and security leads — explaining what was found, why it matters, and how to fix it
- Contribute to security design reviews and threat modelling engagements earlier in the SDLC
- Mentor junior testers on test execution and report quality; contribute to methodology improvements, tooling, and internal playbooks
- Develop domain depth in one or more service areas (web, network, mobile, code review) through our Domain Expertise Program — with formal recognition and stipend for engineers who build expertise that makes the whole team stronger
What We're Looking For
- 2+ years of hands-on manual penetration testing — not scanner-assisted, manual
- Demonstrated ability to run standard engagements end-to-end with minimal oversight: scope, test, report, readout, retest
- Finds that go beyond OWASP Top 10 basics — business logic issues, complex auth flaws, chained vulnerabilities
- Reports that are client-ready with low rework: technically accurate, clearly written, correctly risk-rated
- Software development background in one or more of Python, .NET, Ruby, or Java — you understand how the thing was built, not just how to break it
- Strong communication skills in both directions: writing that doesn't require a translator and calls where you can hold your own in front of an engineering team
- Located in Canada and eligible to work (citizen, permanent resident, or valid work visa)
Nice to Have
- OSCP, OSCP+, or GWAPT
- Experience across multiple service areas (web + mobile, or web + network)
- Familiarity with compliance frameworks that drive our clients' security programs: SOC 2, ISO 27001, PCI DSS, HIPAA
What we are offering:
🤑 Competitive base salary
🍁 Work remotely anywhere in Canada (you're welcome to work in the Ottawa office when you'd like the option).
🌍 Work remotely from anywhere in the world for up to 2 months per year.
💰 Yearly profit-sharing between 5 - 12% of your base salary, based on your performance.
💸 Perks such as: monthly UberEats budget, annual home office stipend.
🌴 3 weeks of vacation to start. Additionally, the whole company is off for the week between Christmas and the New Year.
🍼 Parental, bereavement and child loss leave.
🏥 You will receive a great health benefits package (includes dental, vision, practitioners, etc.).
Originally posted on Himalayas