Freelance Penetration Tester – Canada (Contract)

E12; Edmonton; Hybrid; CAD 60,000 - 90,000; Full time

Benefits offered by this job

Paid per engagement

Flexible engagement selection

Remote within Canada

Job summary

iGears Canada, the Edmonton office of iGears Technology Limited, is building a cybersecurity team to deliver penetration testing for clients in Canada. This independent contractor role is remote within Canada, with engagements ranging from a few days to four weeks, and you choose which engagements to take.

You will run tests on web apps, APIs, and mobile apps, following OWASP WSTG, ASVS and MASVS, and must hold an OSCP or equivalent certification with at least 2 years of hands-on experience.

Qualifications

• OSCP or equivalent hands-on certification is required.
• At least 2 years of hands-on penetration testing experience, with web app and API testing as core skills.
• Ability to invoice as a business and comply with GST/HST where applicable.

Responsibilities

• Run penetration tests of web applications, APIs, and mobile apps for clients in Canada following OWASP WSTG, ASVS and MASVS.
• Test how applications connect to third-party services (OAuth, webhooks, payment and messaging APIs).
• Verify findings by hand, rate risk with CVSS, and write reports in iGears’ template.
• Retest fixes and support verification letters.
• Work within engagement authorisation, ROE, and testing windows.

Skills

OSCP equivalent certification

Penetration testing

Web API testing

Burp Suite Pro

Independent contractor experience

Tools

Burp Suite Professional

Job description

About iGears

iGears Canada is the Edmonton office of iGears Technology Limited, a software company founded in Hong Kong in 2004. We develop and run 20 of our own SaaS products and have shipped 200+ apps for clients including listed companies, public-sector bodies, NGOs, universities and churches. Our Edmonton office opened in 2024, and we are now building a cybersecurity team in Canada to deliver penetration testing for clients and to secure our own platforms.

How we work together

Independent contractor, paid per engagement at an agreed day rate. Work is remote within Canada; engagements run from a few days to about four weeks. You choose which engagements to take.

What you’ll do

• Run penetration tests of web applications, APIs and mobile apps for iGears’ clients in Canada, following OWASP WSTG, ASVS and MASVS
• Test how applications connect to third-party services (OAuth, webhooks, payment and messaging APIs)
• Verify every finding by hand, rate risk with CVSS, and write clear reports in iGears’ report template
• Retest fixes and support verification letters
• Work within each engagement’s written authorisation, rules of engagement and testing window

What you’ll bring

• OSCP, or an equivalent hands-on certification (e.g. CREST CRT or CCT, GIAC GPEN or GWAPT, eWPTX, PNPT)
• At least 2 years of hands-on penetration testing, with web application and API testing as core skills
• Your own testing laptop and licensed tools (e.g. Burp Suite Professional)
• Based in Canada and legally entitled to work in Canada
• Able to invoice iGears as a business, charging GST/HST if you are registered
• Willing to sign an NDA and our rules of engagement, and to complete a background check where a client requires it

Nice to have

• OSWE, OSEP, BSCP or CREST CCT APP
• Experience testing applications in regulated sectors such as financial services
• Cloud (AWS, Azure, GCP) testing or source code review
• Your own professional indemnity insurance

What we offer

• Paid per engagement at an agreed day rate
• Client projects in Canada, plus testing of our own 20 SaaS products
• Flexible: you choose which engagements to take

Explore our platforms before you apply

• AI: GenCMS (gen-cms.com), AskCore (askcore.org), HumanLevelUP (humanlevelup.org), PromoPilot (promo-pilot.org), Webetter (webetter.co), PhotoCen (photocen.com), Duckbot (duckbot.hk, preview)
• Business operations: fileEC (fileec.com), InsightBook (insightbook.org), HRFlowTech (hrflowtech.com), MemberSys (membersys.org), AppointSys (appointsys.org), Paperless.Cards (paperless.ca rds)
• Messaging and marketing: SendPromotion.Email (sendpromotion.email), SendSMS.click (sendsms.click), MarketHK (markethk.net)
• Education and community: LearnSys (learnsys.org), ITChurch (itchurch.online)
• Directories: E12 (e12.hk, e12.ca) and E12 Careers (jobs.e12.hk, jobs.e12.ca)

More at https://www.igears.ca and https://www.igears.com.hk/platforms/

iGears welcomes applications from all qualified candidates. If you need an accommodation at any stage of the recruitment process, please let us know.

We use the information you send us only to assess your application. Applications may be stored and processed by iGears Technology Limited, including by staff and systems in Hong Kong. For questions about how we handle your information, or to ask for our policies on service providers outside Canada, contact Richard Iu, CTO, at [e-mail].

https://e12.ca/pages/company.php?slug=igears-technology