About the role

Penetration Tester focusing on manual security assessments including Network, Cloud, and AI technologies. Engaging in deep security testing with end-to-end ownership and modern tools at BMO.

Responsibilities

The Penetration Tester reports to the Sr. Manager of Network and Strategic Penetration Testing
Responsible for the execution and coordination of ethical hacking to identify weaknesses and areas for improvement
Assists in delivery of security testing projects according to a structured process, including writing test reports
Assists with the execution of highly technical/analytical security assessments of Active Directory environments, network infrastructure, cloud environments, and AI technologies
Advises on secure development practices
Provides technical leadership to business areas as a Security Testing subject matter expert
Identifies security gaps and deficiencies by conducting risk assessments
Assists in the execution of planning, testing, tracking, and advises on necessary risk acceptance for identified security risks
Works with management and peers to foster the development of less experienced Security Testing Consultants

Bachelor’s degree in Information Security, Information Technology, Information Systems Management, Computer Science, Engineering or related field(s) or equivalent demonstrated work experience
Min of 3+ years experience with Manual Penetration Testing of Networks, Cloud Environments
Strong exposure for testing in Active Directory Environments and associated vulnerabilities and exploitation techniques
Strong proficiency with security testing tools and penetration testing Linux distributions such as Kali
Deep practical knowledge of applying the Mitre Attack framework
Preference for candidates who have at least one certification in a related field, with strong preference for Information security certifications from a well-recognized institution (e.g. OSCP, OSEP, HackTheBox Cloud security testing certificates, etc)
Ability to identify and exploit vulnerabilities in Active Directory environments and Cloud workflows as well as multi-step attack paths
Proficiency in at least one scripting language
Ability in documenting reproducible steps for technical accurate findings
Experience with security testing of agentic AI solution is a plus
Experience with security testing of CI/CD pipelines is a plus