Penetration Testing Analyst (Cybersecurity)

Location: Toronto, Ontario, Canada; hybrid work from home or the office based on business and Client needs. Waterloo, Ontario is also listed as a possible location.

Salary: CAD 70,000–105,000 per year.

Company

hirify.global provides financial security and health-related services to Clients, families, and communities.

What you will do

• Perform web, API, mobile, and infrastructure penetration testing across enterprise applications.
• Identify, exploit, and validate vulnerabilities through manual testing and industry tools, following OWASP and other established methodologies.
• Produce structured reports covering vulnerabilities, root causes, business impact, risk ratings, and practical remediation recommendations.
• Research new vulnerabilities, exploits, and attack techniques, and support remediation retesting.
• Contribute to reconnaissance, attack-surface mapping, attack-path analysis, and documentation of security gaps.
• Support Red Team and adversary simulation exercises, including controlled initial-access and limited post-exploitation validation under guidance.

Requirements

• Bachelor’s degree in computer science, information security, or a related field.
• At least 2 years of hands-on professional experience with web application security testing, including OWASP Top 10, API security testing, and basic network or infrastructure testing.
• Strong understanding of authentication, session management, access-control flaws, input validation, and injection vulnerabilities.
• Experience with Burp Suite, Nmap, sqlmap, or similar tools.
• Ability to perform manual testing beyond automated scanning.
• Strong documentation and reporting skills, with a focus on clear risk articulation.
• Basic understanding of adversary simulation concepts and the attack lifecycle, including reconnaissance and common initial compromise methods.
• Awareness of privilege escalation, lateral movement, and attack paths across enterprise environments.
• Ability to satisfactorily complete applicable background checks before the start date and during employment.

Nice to have

• Practical penetration-testing certifications such as OSCP, OSWA, CWES, or BSCP.
• Interest in developing Red Team and broader offensive-security capabilities over time.

Culture & Benefits

• Hybrid flexibility to work from home or in the office according to business and Client needs.
• Wellness programs supporting mental, physical, and financial health.
• Opportunities to pursue varied career paths and build a professional network.
• Recognition as a 2026 Best Workplace in Canada and Canada Order of Excellence for Mental Health at Work certification.
• Commitment to diversity, inclusion, employee well-being, and a positive work culture.