About the role

Penetration Testing Analyst performing web, API, mobile, and infrastructure security testing at Sun Life. Supporting vulnerability remediation, reconnaissance, and foundational Red Team exercises.

Responsibilities

Perform web, API, mobile, and infrastructure penetration testing across enterprise applications
Identify, exploit, and validate security vulnerabilities using manual testing techniques and industry tools
Conduct testing in line with established methodologies and security frameworks such as OWASP
Produce clear, structured reports covering vulnerabilities, root cause, business impact, risk rating, and remediation recommendations
Research new vulnerabilities, exploits, and attack techniques to enhance testing coverage
Support re-testing activities to validate remediation
Support Red Team or adversary simulation exercises when required
Contribute to reconnaissance, attack surface mapping, and identification of potential attack paths
Document attack paths and identified security gaps
Assist in controlled exploitation activities, including initial access techniques and limited post-exploitation validation
Collaborate with senior team members to understand real-world attacker behavior and techniques

Bachelor’s degree in computer science, Information Security, or a related field
2+ years of hands-on professional experience in web application security testing, API security testing, and basic network/infrastructure testing
Strong understanding of authentication, session management, access control flaws, input validation, and injection vulnerabilities
Experience with Burp Suite, Nmap, sqlmap, or similar tools
Ability to perform manual testing beyond automated scanning
Strong documentation and reporting skills, with focus on clear risk articulation
Basic understanding of adversary simulation concepts and attack lifecycle
Familiarity with reconnaissance techniques and common initial compromise methods
Awareness of privilege escalation, lateral movement concepts, and attack paths across enterprise environments
Must be able to satisfactorily complete applicable background checks prior to the start date and during employment
Practical PenTesting certifications such as OSCP, OSWA, CWES, and BSCP are desired but not required

Wellness programs that support mental, physical, and financial health
Variety of career paths with networking potential
Hybrid work arrangement with flexibility to work from home or in the office
Incentive plans for eligible employees, with payment discretionary and subject to individual and company performance
Workplace accommodation support for persons with disabilities
Flexible choice to work virtually or from the office based on business, Client, and employee needs