Remote Penetration Tester - Offensive Security

Malleum; Penticton; Hybrid; CAD 90,000 - 130,000; Full time

Benefits offered by this job

Certification sponsorship

Continuous learning budget

Competitive compensation

Job summary

Malleum is seeking a Penetration Tester to deliver hands-on offensive security engagements across client networks, applications, cloud environments, and OT/ICS. You will emulate real-world adversaries, document findings, and guide remediation within sovereign, regulated, and cleared settings.

This hands-on consulting role requires deep technical tradecraft, strong client presence, and the discipline to deliver findings clearly, safely, and on schedule.

Qualifications

• 4+ years of professional penetration testing or red team experience.
• Experience working directly with clients and strong communication.
• Deep knowledge of network, web app, and AD attack paths.
• Hands-on proficiency with offensive tooling and scripting.
• Ability to emulate adversary TTPs mapped to MITRE ATT&CK.
• Familiarity with PTES, OWASP WSTG, NIST SP 800-115.

Responsibilities

• Plan, scope, and execute penetration tests across multiple targets.
• Conduct red team and adversary emulation engagements.
• Perform internal pivoting, privilege escalation, and lateral movement exercises.
• Support purple team activities to improve detection and response.
• Deliver high-quality client deliverables and briefings.
• Develop custom tooling and payloads to support engagements.
• Maintain engagement hygiene and ROE across client projects.

Skills

Penetration testing

Red team

Client communication

Adversary emulation

MITRE ATT&CK

AD attack paths

Network testing

Web app testing

Python scripting

PowerShell

C# / Go

EDR evasion

Cloud testing Azure/AWS

ZTNA / identity perimeter

Adversary TTPs

PTES / OWASP / NIST

Clearance eligibility

English/French bilingual

Education

OSCP

OSEP

OSWE

OSCE3

CRTO

GPEN

GPCS / GCLD

SC-100

Tools

Burp Suite Pro

Nmap

Nessus

Nuclei

Metasploit

Cobalt Strike

Sliver

BloodHound

CrackMapExec

NetExec

Responder

Mimikatz

Impacket

Mythic

Job description

Location: Hybrid / On-site at client locations as required
Department: Offensive Security & Adversary Simulation

About Malleum

Malleum is at the forefront of next-generation cyber defense, partnering with marquee clients across space, aerospace, defense, government, financial services, and critical infrastructure. We’re experiencing exceptional growth as demand accelerates for trusted advisors capable of delivering at the intersection of national security, allied intelligence cooperation, and enterprise resilience. Our offensive security consultants test the systems behind cutting-edge defensive technologies, sovereign space capabilities, and allied programs – finding the gaps before adversaries do, on networks that protect missions of genuine national consequence.

If you take pride in breaking things ethically – and helping the most consequential organizations build back stronger – Malleum is where your craft meets purpose.

The Opportunity

We’re seeking a Penetration Tester to deliver hands-on offensive security engagements across client networks, applications, cloud environments, and operational technology. You’ll work directly within client environments – including sovereign, regulated, and cleared settings – emulating real-world adversaries, documenting findings, and partnering with clients to drive meaningful remediation.

This is a hands-on consulting role for a practitioner who blends deep technical tradecraft with strong client presence and the discipline to deliver findings clearly, safely, and on schedule.

What You’ll Do

• Plan, scope, and execute penetration tests across external, internal, web application, API, mobile, cloud (Azure / AWS / GCP), wireless, and Active Directory targets


• Conduct red team and adversary emulation engagements aligned to MITRE ATT&CK, executing realistic TTPs against client environments


• Perform assumed-breach assessments, internal pivoting, privilege escalation, and lateral movement exercises


• Support purple team exercises in partnership with client SOC and Malleum’s IR practice to improve detection and response


• Execute social engineering campaigns (phishing, vishing, physical) where contracted, with rigorous rules of engagement


• Conduct cloud configuration reviews against CIS Benchmarks, CSA CCM, and provider-specific baselines


• Support OT / IC S / SCADA security testing for defense and critical-infrastructure clients (with appropriate safety controls)


• Develop custom tooling, scripts, and payloads (PowerShell, Python, C#, Go) to evade modern EDR and ZTNA controls during sanctioned engagements


• Produce high-quality client deliverables: executive summaries, technical findings, reproduction steps, evidence, CVSS-scored risk ratings, and pragmatic remediation guidance


• Deliver findings briefings to client stakeholders — from engineers to executive leadership and boards – with clarity and professionalism


• Contribute to scoping, estimation, statements of work, and continuous improvement of Malleum’s offensive security service offerings


• Maintain meticulous engagement hygiene: rules of engagement, scope control, evidence handling, and safe-listing coordination


• Participate in research, internal tooling development, CTFs, and conference contributions to grow Malleum’s offensive capability and brand

What You Bring

• 4+ years of professional penetration testing or red team experience, ideally in a consulting, MSSP, or in-house offensive security team


• Demonstrated success working directly with clients – strong communication, professionalism, and stakeholder management skills


• Deep working knowledge of network, web application, and Active Directory attack paths (Kerberoasting, AS-REP roasting, NTLM relay, ADCS abuse, BloodHound-driven pathing)


• Hands-on proficiency with offensive tooling: Burp Suite Pro, Nmap, Nessus / Nuclei, Metasploit, Cobalt Strike, Sliver, Mythic, Impacket, BloodHound, CrackMapExec / NetExec, Responder, Mimikatz, and modern C2 frameworks


• Strong scripting skills in Python, PowerShell, and Bash; comfort reading and modifying C#, Go, or Rust tooling


• Experience evading or bypassing EDR (Defender, CrowdStrike, SentinelOne), AMSI, and modern Windows defenses


• Familiarity with cloud attack paths in Azure / Entra ID (Pass-the-PRT, illicit consent grants, managed identity abuse) and AWS (IAM privilege escalation, metadata service abuse)


• Solid grasp of ZTNA and identity-aware perimeters (e.g., Cloudflare Access, Zscaler, Entra Conditional Access) and how they reshape attacker tradecraft


• Comfort emulating adversary TTPs mapped to MITRE ATT&CK and known threat-actor playbooks


• Familiarity with testing standards: PTES, OWASP WSTG / MASTG / ASVS, NIST SP 800-115, OSSTMM


• Awareness of compliance contexts that frame client expectations: PCI DSS, SOC 2, NIST 800-171 / CMMC, CPCSC, ITSG-33, ISO 27001:2022


• Certifications such as OSCP, OSEP, OSWE, OSCE3, CRTO, CRTL, GPEN, GXPN, GWAPT, GMOB, GCSA / GPCS / GCLD (cloud), AWS Certified Security – Specialty, Microsoft SC-100 / AZ-500 strongly preferred; OSCP or equivalent practical certification (e.g., CRTO, HTB CPTS, PNPT) is a baseline expectation


• Demonstrated ability to perform under pressure – calm, methodical, and ethical when engagements surface sensitive findings


• Willingness and availability to work odd hours and extended shifts when supporting time-boxed red team windows, after-hours testing, or rapid-response offensive support during active IR matters


• Comfort working across multiple client environments, tooling stacks, and rules-of-engagement simultaneously


• Eligibility for Government of Canada security clearance (Secret or higher); existing clearance highly valued; or controlled-goods registration considered an asset


• Bilingualism (English/French) considered a strong asset

Why Malleum

• Test the systems behind programs with genuine national and allied security impact – across aerospace, defense, and critical infrastructure


• Join a rapidly scaling firm with a flat, high-trust culture and direct access to senior offensive, IR, and engineering leaders


• Exposure to a wide variety of advanced targets, sectors, and cleared environments


• Dedicated research time, lab budget, and support for conference talks, CVE research, and open-source contributions


• Competitive compensation, performance incentives, and comprehensive benefits


• Continuous learning budget, certification sponsorship (OSCP, OSEP, OSWE, CRTL, SANS), and clear paths into senior red team, exploit development, or offensive research specializations

Malleum is an equal opportunity employer. We welcome applications from all qualified candidates and are committed to building a team that reflects the communities and missions we serve.

We are proud to accommodate individuals with disabilities throughout the recruitment and selection process. Please indicate your need for accommodations in your application.