Pen test platform Professional

Job Summary

We are seeking an Expert-level Information Security Consultant to drive the ongoing maturity of Fraser Healths penetration testing program. In this role, you will perform end-to-end grey-box penetration tests across a large portfolio of web and API applications while utilizing a secure, browser-based management platform to schedule assessments, track vulnerabilities, and manage remediation lifecycles.

Responsibilities

• Scoping & Sizing: Conduct T-shirt sizing (Small, Medium, Large) and scoping for onboarded applications based on dynamic web pages and user roles.
• Penetration Testing Execution: Execute manual and tool-assisted grey-box penetration tests across approximately Web/API applications, completing testing within defined schedules.
• Engagement Lifecycles: Manage the end-to-end testing lifecycle for each application from kickoff meeting to final sign-off within a defined timeframe.
• In-Depth Vulnerability Assessment: Conduct expert manual assessments covering authentication, session management, MFA bypass, horizontal/vertical privilege escalation, IDOR/BOLA, API vulnerabilities, and business logic workflow abuses.
• Attack-Path Validation: Chain vulnerabilities into realistic attack paths and perform controlled, non-destructive validation within live healthcare environments without disrupting operational or clinical systems.
• Platform Management: Deploy and operate a browser-based, RBAC/MFA-enabled pen test platform supporting forward scheduling, metric dashboards, report retention, automated notifications, and GRC tool integration.
• Tooling & Environment Setup: Install, configure, and maintain all necessary licensed testing tools inside the client-provided penetration testing machines accessed via the Privileged Access Management (PAM) platform.
• Reporting & Debriefs: Author comprehensive reports with testing methodologies, scorecards, reproducible steps, root-cause analyses, and prioritized remediation guidance, followed by stakeholder presentations.
• Remediation Tracking & Retesting: Follow up with application owners on vulnerability mitigations and perform targeted retests on resolved findings.

Required Qualifications & Experience

• Certifications: Active penetration testing certification such as OSCP (Offensive Security Certified Professional), CEH (Certified Ethical Hacker), or an equivalent credential.
• Seniority Threshold (Expert Level): Relevant Degree + minimum 6 years of consulting experience.
• Relevant Diploma + minimum 7 years of consulting experience.
• Relevant Certificate + minimum 8 years of consulting experience.
• Minimum 10 years of directly related consulting experience.
• Healthcare & Production Experience: Demonstrated experience performing penetration testing safely in Canadian healthcare or sensitive enterprise environments with zero clinical/operational impact.
• Employment Status: Must be a permanent employee of the service provider (subcontracting is prohibited).
• Framework Alignment: Practical working knowledge of OWASP, NIST SP 800-53A, PCI DSS 11.3, and IDART standards.

Job Type

Contract

Disclaimer: This job posting & Location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.