Penetration Tester

Software Secured; Ottawa; Hybrid; CAD 70,000 - 110,000; Full time

Benefits offered by this job

Remote work from anywhere in Canada

Yearly profit-sharing 5-12% of base

Home office stipend

Job summary

Software Secured is a leading PTaaS company with a head office in Ottawa, Canada. The Penetration Tester role offers remote, full-time permanent work while you must be located in Canada. You will perform security tests across web, mobile, and network surfaces and contribute to threat modelling and design reviews.

You will mentor junior testers, help improve methodologies, and build domain depth in web, network, and code review avenues, supported by a comprehensive benefits package.

Qualifications

• 2+ years of hands-on manual penetration testing.
• Ability to run standard engagements end-to-end with minimal oversight.
• Finds beyond OWASP Top 10 basics: business logic issues and complex auth flaws.
• Reports are client-ready, technically accurate and clearly risk-rated.

Responsibilities

• Run manual penetration tests across web apps, APIs, mobile apps, and networks, from scoping to retest.
• Produce findings that are exploitable with remediation guidance for developers.
• Handle nuanced test cases beyond standard checklists.

Skills

Manual pentesting

End-to-end testing

Reporting

Communication

Threat modelling

Tools

Python

.NET

Ruby

Java

Job description

Software Secured is a leading Penetration Testing as a Service (PTaaS) company, with a head office in beautiful Ottawa, Canada. We help software development teams get ahead of hackers, using a suite of cybersecurity services and products. Software Secured focuses on helping startups, scaleups, and SMBs comply with industry-specific Governance, Risk and Compliance frameworks (SOC 2, ISO27001 & PCI DSS, HIPAA, etc), prove security maturity to enterprise buyers with stringent security requirements and gain peace of mind that their most sensitive company assets have been secured.

The Role

As a Penetration Tester at Software Secured, you will have the opportunity to help our clients secure their mission‑critical applications. This includes performing security code review, web, mobile, and network security tests. Help clients with security design reviews, threat modelling, and remediation strategies. This is a remote, full‑time permanent role. However, you must be located in Canada, either a Canadian citizen or a PR holder.

What You'll Do

• Run manual penetration tests across web applications, APIs, mobile apps, and network infrastructure — from scoping through testing, reporting, client readout, and retest
• Produce findings that are manually confirmed and exploitable, with remediation guidance a developer can act on without a follow-up call
• Handle nuanced test cases beyond the standard checklist: business logic flaws, authorization edge cases, vulnerability chaining, and environment‑specific attack paths
• Present findings directly to client engineering teams and security leads — explaining what was found, why it matters, and how to fix it
• Contribute to security design reviews and threat modelling engagements earlier in the SDLC
• Mentor junior testers on test execution and report quality; contribute to methodology improvements, tooling, and internal playbooks
• Develop domain depth in one or more service areas (web, network, mobile, code review) through our Domain Expertise Program — with formal recognition and stipend for engineers who build expertise that makes the whole team stronger

What We’re Looking For

• 2+ years of hands‑on manual penetration testing — not scanner‑assisted, manual
• Demonstrated ability to run standard engagements end‑to‑end with minimal oversight: scope, test, report, readout, retest
• Finds that go beyond OWASP Top 10 basics — business logic issues, complex auth flaws, chained vulnerabilities
• Reports that are client‑ready with low rework: technically accurate, clearly written, correctly risk‑rated
• Software development background in one or more of Python, .NET, Ruby, or Java — you understand how the thing was built, not just how to break it
• Strong communication skills in both directions: writing that doesn't require a translator and calls where you can hold your own in front of an engineering team
• Located in Canada and eligible to work (citizen, permanent resident, or valid work visa)

Nice to Have

• OSCP, OSCP+, or GWAPT
• Experience across multiple service areas (web + mobile, or web + network)
• Familiarity with compliance frameworks that drive our clients' security programs: SOC 2, ISO 27001, PCI DSS, HIPAA

What we are offering

• Competitive base salary
• Work remotely from anywhere in Canada (you're welcome to work in the Ottawa office when you prefer).
• Work remotely from anywhere in the world for up to 2 months per year.
• Yearly profit‑sharing between 5 - 12% of your base salary, based on your performance.
• Perks such as: monthly UberEats budget, annual home office stipend.
• 3 weeks of vacation to start. Additionally, the whole company is off for the week between Christmas and the New Year.
• Parental, bereavement and child loss leave.
• You will receive a comprehensive health benefits package (including dental, vision, and practitioner coverage, among others).