Remote Senior Penetration Tester - Web & API Platforms

NEPSE Trading; Northern (KY); Hybrid; USD 120,000 - 210,000; Full time

Job summary

Fraser Health is seeking an Expert-level Information Security Consultant to advance the organization’s penetration testing program. This remote role conducts grey-box tests across a broad Web/API portfolio, manages assessments through a secure management platform, and drives remediation lifecycles with emphasis on patient data safety.

Responsibilities include scoping, executing tests, generating detailed reports, and coordinating with owners for validated remediation, while adhering to

Qualifications

• Active penetration testing certifications such as OSCP or CEH.
• Minimum 10 years of directly related consulting experience.
• Healthcare and production experience in sensitive environments with zero impact.
• Permanent employee of the service provider (no subcontracting).
• Familiarity with OWASP, NIST SP 800-53A, PCI DSS 11.3 and related standards.

Responsibilities

• Perform end-to-end grey-box penetration tests across Web/API applications.
• Chain vulnerabilities into realistic attack paths and validate in clinical environments.
• Manage testing lifecycles from kickoff to final sign-off within tight SLAs.
• Author comprehensive reports with methodologies, findings, and remediation guidance.
• Coordinate remediation tracking and retests with application owners.

Skills

Expert-level

Penetration testing

Threat modeling

OWASP

NIST SP 800-53A

Education

Relevant Degree

Relevant Diploma

Relevant Certificate

Tools

PAM platform

RBAC

MFA

GRC tools

Job description

Fraser Health is seeking an Expert-level Information Security Consultant to advance the organization’s penetration testing program. This remote role conducts grey-box tests across a broad Web/API portfolio, manages assessments through a secure management platform, and drives remediation lifecycles with emphasis on patient data safety.

Responsibilities include scoping, executing tests, generating detailed reports, and coordinating with owners for validated remediation, while adhering to