Penetration Testing Analyst

Sun Life

. Perform web, API, mobile, and infrastructure penetration testing across enterprise applications .

Posted 10/18/2026full-timeToronto • CanadaJuniorMid-Level💰 CA$70,000 - CA$105,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in web, API, and infrastructure penetration testing, with a strong focus on identifying and validating security vulnerabilities using established methodologies and tools. Proficient in producing detailed reports that articulate risks and remediation strategies while collaborating effectively with team members.

Highest-signal resume keywords

Web Application Security TestingAPI Security TestingManual Testing TechniquesBurp SuiteOSCP Certification

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Penetration TestingVulnerability AssessmentRisk RatingInput ValidationInjection VulnerabilitiesAuthentication FlawsSession ManagementAccess Control FlawsAdversary SimulationReconnaissance Techniques

Soft Skills

Documentation SkillsReporting SkillsCollaboration

Tools & Technologies

Burp SuiteNmapSqlmap

Certifications & Qualifications

OSCPOSWACWESBSCP

Industry Keywords

OWASPAttack Surface MappingPrivilege EscalationLateral MovementInitial Access Techniques

About the role

Key responsibilities & impact

Perform web, API, mobile, and infrastructure penetration testing across enterprise applications
Identify, exploit, and validate security vulnerabilities using manual testing techniques and industry tools
Conduct testing in line with established methodologies and security frameworks such as OWASP
Produce clear, structured reports covering vulnerabilities, root cause, business impact, risk rating, and remediation recommendations
Research new vulnerabilities, exploits, and attack techniques to enhance testing coverage
Support re-testing activities to validate remediation
Support Red Team or adversary simulation exercises when required
Contribute to reconnaissance, attack surface mapping, and identification of potential attack paths
Document attack paths and identified security gaps
Assist in controlled exploitation activities, including initial access techniques and limited post-exploitation validation
Collaborate with senior team members to understand real-world attacker behavior and techniques

Requirements

What you’ll need

Bachelor’s degree in computer science, Information Security, or a related field
2+ years of hands-on professional experience in web application security testing, API security testing, and basic network/infrastructure testing
Strong understanding of authentication, session management, access control flaws, input validation, and injection vulnerabilities
Experience with Burp Suite, Nmap, sqlmap, or similar tools
Ability to perform manual testing beyond automated scanning
Strong documentation and reporting skills, with focus on clear risk articulation
Basic understanding of adversary simulation concepts and attack lifecycle
Familiarity with reconnaissance techniques and common initial compromise methods
Awareness of privilege escalation, lateral movement concepts, and attack paths across enterprise environments
Must be able to satisfactorily complete applicable background checks prior to the start date and during employment
Practical PenTesting certifications such as OSCP, OSWA, CWES, and BSCP are desired but not required

Benefits

Comp & perks

Wellness programs that support mental, physical, and financial health
Variety of career paths with networking potential
Hybrid work arrangement with flexibility to work from home or in the office
Incentive plans for eligible employees, with payment discretionary and subject to individual and company performance
Workplace accommodation support for persons with disabilities
Flexible choice to work virtually or from the office based on business, Client, and employee needs