Penetration Tester

Software Secured; United States; Remote; USD 95,000 - 130,000; Full time

Benefits offered by this job

UberEats budget

Home office stipend

3 weeks vacation + company closure for

Health benefits

Job summary

Software Secured is seeking a Pentester to join our team and secure hundreds of applications. You will perform security code reviews, web, mobile, and network testing, and assist with design reviews and threat modelling.

You’ll mentor junior testers and contribute to tooling and playbooks to strengthen the team. You should have 2+ years of hands-on manual testing, experience delivering end-to-end engagements, and strong written and verbal communication for client-facing delivery.

Qualifications

• 2+ years of hands-on manual penetration testing, not scanner-assisted.
• Ability to run standard engagements end-to-end: scope, test, report, readout, retest.
• Reports must be client-ready with technical accuracy and proper risk rating.

Responsibilities

• Run manual penetration tests across web apps, APIs, mobile apps, and network infrastructure from scoping to retest.
• Produce findings with actionable remediation guidance for developers.
• Handle business logic flaws, complex auth issues, vulnerability chaining, and environment-specific paths.
• Present findings to client engineers and security leads with clear explanations and fixes.
• Contribute to security design reviews and threat modelling earlier in the SDLC.
• Mentor junior testers and contribute to methodology improvements and tooling.
• Develop domain depth through our Domain Expertise Program with formal recognition and stipends.

Skills

Manual penetration testing

End-to-end engagements

Security design reviews

Threat modelling

Mentoring juniors

Python

.NET

Ruby

Java

Communication

Job description

Software Secured is a leading Penetration Testing as a Service company, with a head office in beautiful Ottawa, Canada. We help software development teams get ahead of hackers using a suite of services and products.

Our team of pentesters is seeking a pentester to join us and help secure a few hundred additional applications.

As a Pentester at Software Secured, you will have the opportunity to help our clients secure their mission‑critical applications. This includes performing security code review, web, mobile, and network security tests. Help clients with security design reviews, threat modelling, and remediation strategies.

What You'll Do

• Run manual penetration tests across web applications, APIs, mobile apps, and network infrastructure — from scoping through testing, reporting, client readout, and retest
• Produce findings that are manually confirmed and exploitable, with remediation guidance a developer can act on without a follow‑up call
• Handle nuanced test cases beyond the standard checklist: business logic flaws, authorization edge cases, vulnerability chaining, and environment‑specific attack paths
• Present findings directly to client engineering teams and security leads — explaining what was found, why it matters, and how to fix it
• Contribute to security design reviews and threat modelling engagements earlier in the SDLC
• Mentor junior testers on test execution and report quality; contribute to methodology improvements, tooling, and internal playbooks
• Develop domain depth in one or more service areas (web, network, mobile, code review) through our Domain Expertise Program — with formal recognition and stipend for engineers who build expertise that makes the whole team stronger

What We're Looking For

• 2+ years of hands‑on manual penetration testing — not scanner‑assisted, manual
• Demonstrated ability to run standard engagements end‑to‑end with minimal oversight: scope, test, report, readout, retest
• Finds that go beyond OWASP Top 10 basics — business logic issues, complex auth flaws, chained vulnerabilities
• Reports that are client‑ready with low rework: technically accurate, clearly written, correctly risk‑rated
• Software development background in one or more of Python, .NET, Ruby, or Java — you understand how the thing was built, not just how to break it
• Strong communication skills in both directions: writing that doesn't require a translator and calls where you can hold your own in front of an engineering team
• Located in Canada and eligible to work (citizen, permanent resident, or valid work visa)

Nice to Have

• OSCP, OSCP+, or GWAPT
• Experience across multiple service areas (web + mobile, or web + network)
• Familiarity with compliance frameworks that drive our clients' security programs: SOC 2, ISO 27001, PCI DSS, HIPAA

What we are offering:

Competitive base salary

Work remotely anywhere in Canada (you're welcome to work in the Ottawa office when you'd like the option).

Work remotely from anywhere in the world for up to 2 months per year.

Yearly profit‑sharing between 5 - 12% of your base salary, based on your performance.

Perks such as: monthly UberEats budget, annual home office stipend.

3 weeks of vacation to start. Additionally, the whole company is off for the week between Christmas and the New Year.

Parental, bereavement and child loss leave.

You will receive a great health benefits package (includes dental, vision, practitioners, etc.).