Penetration Testing Analyst: Web & API Security, Red Team

Sun Life; Wellesley (MA); On-site; USD 110,000 - 165,000; Full time

Benefits offered by this job

22 Days Annual Leave

Maternity Leave

Paternity Leave

Parental Leave

Fitness Reimbursement

Annual Bonus plan

Private Health Insurance

Study Assistance Programme

Wellness Programme

Pension Scheme

Professional Development Training

Job summary

Sun Life is seeking a skilled Penetration Testing Analyst to conduct hands-on security testing of applications and infrastructure. The role focuses on penetration testing delivery with secondary exposure to Red Team activities and adversary simulations where needed.

You will perform web, API, mobile, and infrastructure testing, identify vulnerabilities, and provide clear, actionable remediation guidance. A Bachelor's degree in a related field is required; OSCP/ CISSP-like certifications are

Qualifications

• Hands-on web app security testing (OWASP Top 10) and API testing.
• Understanding of authentication, session mgmt, and access control flaws.
• Experience with security testing tools (Burp Suite, Nmap, sqlmap) and manual testing.

Responsibilities

• Perform web, API, mobile, and infrastructure penetration testing across enterprise applications.
• Identify, exploit, and validate security vulnerabilities with manual testing techniques.
• Produce clear, structured reports outlining vulnerabilities, business impact, risk rating, and remediation recommendations.
• Conduct research into new vulnerabilities, exploits, and attack techniques to enhance testing coverage.
• Support Red Team or adversary simulation exercises where required.

Skills

Web application security testing

API security testing

Basic network testing

Authentication flaws

Input validation vulnerabilities

Burp Suite

Nmap

sqlmap

Manual testing

Clear risk articulation

Education

Bachelor's degree in Computer Science or Information Security

Tools

Burp Suite

Nmap

sqlmap

Job description

Sun Life is seeking a skilled Penetration Testing Analyst to conduct hands-on security testing of applications and infrastructure. The role focuses on penetration testing delivery with secondary exposure to Red Team activities and adversary simulations where needed.

You will perform web, API, mobile, and infrastructure testing, identify vulnerabilities, and provide clear, actionable remediation guidance. A Bachelor's degree in a related field is required; OSCP/ CISSP-like certifications are