Security Specialist (Penetration Tester) 8435-3112

Dheya; Toronto; Hybrid; CAD 70,000 - 110,000; Full time

Job summary

Join a forward-thinking company as a Security Specialist (Penetration Tester) in a hybrid role where you'll conduct critical penetration tests and vulnerability assessments. This dynamic position involves evaluating security architecture, advising on risk management, and ensuring compliance with industry standards. You'll work closely with the Ontario Public Service's I&T infrastructure, contributing to the protection of sensitive information. If you have a passion for cybersecurity and a knack for problem-solving, this is an exciting opportunity to make a significant impact in a collaborative environment. Your expertise will help shape the future of security practices in a diverse and challenging landscape.

Qualifications

• Current penetration test experience is mandatory.
• Experience with vulnerability assessment methodologies and tools.

Responsibilities

• Conduct penetration tests and vulnerability assessments for various systems.
• Advise on security architecture requirements and risk management.

Skills

Penetration Testing

Vulnerability Assessment

Network Security

Exploit Development

Scripting Languages (Python, Bash)

Intrusion Detection Systems (IDS)

Risk Management

Client Communication

Security Frameworks (e.g., OWASP, NIST)

Job description

Security Specialist (Penetration Tester) 8435-3112

Skills Required:

• Penetration Testing
• Vulnerability Assessment
• Network Security
• Exploit Development
• Scripting Languages (Python, Bash)
• Intrusion Detection Systems (IDS)
• Risk Management
• Client Communication
• Security Frameworks (e.g., OWASP, NIST)

HM Note: This hybrid contract role is three (3) days in office. Candidate's resume must include first and last name. The role commences April 1, 2025.

Description:

Responsibilities:

1. Conduct penetration tests, web application vulnerability assessments, code reviews, and network vulnerability assessments of all environments or applications related to the OPS province-wide I&IT infrastructure and information resources.
2. Define, evaluate, and assess security architecture requirements for systems environments and IT projects.
3. Ensure the incorporation of IT security and contingency measures in the development of systems.
4. Advise on the identification, analysis, and resolution of specific security factors, risks, vulnerabilities; protection of personal privacy issues; and appropriate industry and international security standards.
5. Carry out information and information technology (I&IT) security projects and tasks in the Ontario Public Service as assigned by Corporate Security or cluster I&IT management.

General Skills:

1. Experience in vulnerability assessment/penetration testing of web applications by identifying, analyzing, and exploiting common vulnerabilities using manual techniques and automated tools appropriate for enterprise use.
2. Experience performing penetration tests and red team assessments.
3. Experience with vulnerability assessment methodologies, tools, and techniques used to conduct network vulnerability assessments and penetration testing.
4. Knowledge of techniques to secure information assets and the planning, design, and implementation of security technologies.
5. Proven techniques to discover gaps or weaknesses in security architecture to identify and mitigate known security threats or inherent weaknesses.
6. Strong understanding and expertise in security architecture.
7. Knowledge and understanding of relevant legislation and corporate directives related to the security and confidentiality of information.
8. Solid knowledge of current security and contingency technology and techniques, and a proven working knowledge of security audit procedures and protocols.
9. Experience in establishing secure environments at a network, operating system, or application level.
10. Experience with implementing security on complex and distributed systems.
11. Experience in writing reports to a large audience both at an executive/non-technical management level and technical resources.
12. Awareness of emerging IT trends and directions, especially as related to security.
13. Excellent analytical, problem-solving, and decision-making skills; written and verbal communication skills; interpersonal and negotiation skills.
14. A team player with a track record for meeting deadlines, managing competing priorities, and client relationship management experience.
15. Experience with multiple operating systems such as Windows and Linux, multiple programming languages such as .NET and Java, and common network services and protocols.

Mandatory Requirement:

Current penetration test experience

PENETRATION TEST EXPERIENCE: 35%

Demonstrated experience in identifying, analyzing, and exploiting common vulnerabilities using both manual techniques and automated tools for web and network pen testing and vulnerability assessments. Demonstrated experience in leading penetration tests, web application vulnerability assessments, code reviews, and network vulnerability assessments in a large environment with diverse systems; and in common attacks, common web application vulnerabilities, exploits, and best practices for remediation.

TECHNICAL EXPERTISE: 25%

Experience with multiple operating systems, programming and scripting languages, platforms, and network services and protocols. Understanding of emerging I&IT trends, best practices, and developments in common attacks, common web application vulnerabilities, exploits, and best practices for remediation.

ANALYTICAL AND PROBLEM SOLVING SKILLS: 20%

Demonstrated analytical and problem-solving skills to determine alternative and innovative solutions where guidelines or policies exist but may not address new and emerging I&IT trends. Ability to conceptualize, interpret, and evaluate security exposures across multiple domains.

COMMUNICATION AND RELATIONSHIP BUILDING SKILLS: 10%

Experience with writing reports aimed at both the executive/non-technical management level, and technical analyst level. Oral and written communication, mediation, negotiation, consultative and advisory skills. Skills to provide training in the use of commercial security assessment tools and scanners. Stakeholder management, partnership, and relationship building skills to initiate and nurture strong working relationships with internal and external colleagues.

LEADERSHIP AND PROJECT MANAGEMENT SKILLS: 10%

Proven ability to provide leadership, advice, and direction on business risk planning and coordination. Demonstrated project methodology and management skills to provide project planning and technical leadership on concurrent projects.