About the role

Penetration Testing Analyst testing Sun Life financial-services applications, APIs, mobile systems, and infrastructure. Supporting vulnerability remediation and foundational Red Team exercises.

Responsibilities

Perform web, API, mobile, and infrastructure penetration testing across enterprise applications
Identify, exploit, and validate security vulnerabilities using manual testing techniques and industry tools
Conduct testing according to established methodologies and security frameworks such as OWASP
Produce structured reports covering vulnerabilities, root causes, business impact, risk ratings, and remediation recommendations
Research new vulnerabilities, exploits, and attack techniques to enhance testing coverage
Support re-testing to validate remediation of identified issues
Support Red Team or adversary simulation exercises when required
Contribute to reconnaissance, attack-surface mapping, and identification of potential attack paths
Support documentation of attack paths and security gaps
Assist with controlled exploitation, including initial access techniques and limited post-exploitation validation
Collaborate with senior team members to understand real-world attacker behavior and techniques

Bachelor’s degree in computer science, Information Security, or a related field
Practical penetration testing certifications such as OSCP, OSWA, CWES, or BSCP are desired but not required
2+ years of hands-on professional experience in web application security testing, API security testing, and basic network/infrastructure testing
Strong understanding of authentication, session management, access control flaws, input validation, and injection vulnerabilities
Experience with Burp Suite, Nmap, sqlmap, or similar tools
Ability to perform manual testing beyond automated scanning
Strong documentation and reporting skills, with focus on clear risk articulation
Basic understanding of adversary simulation concepts and attack lifecycle
Familiarity with reconnaissance techniques and common initial compromise methods
Awareness of privilege escalation, lateral movement, and attack paths across enterprise environments
Must be able to satisfactorily complete applicable background checks prior to the start date and during employment

Wellness programs supporting mental, physical, and financial health
Career-path opportunities
Networking potential
Hybrid work with flexibility to work from home or in the office
Incentive plans for eligible employees, with discretionary payments based on individual and company performance
Accommodation support during the application process
Diverse and inclusive workplace