Software Secured is a leading PTaaS company headquartered in Ottawa, Canada, helping startups, scaleups, and SMBs comply with industry-specific security frameworks. As a Penetration Tester, you will perform manual security assessments across web applications, APIs, mobile apps, and network infrastructure, produce client-ready reports, and mentor junior testers. You must have 2+ years of hands-on manual penetration testing experience, strong communication skills, and be located in Canada with the right to work.
Key Highlights
Key Responsibilities
Technical Skills Required
Benefits & Perks
Nice to Have
Job Description
Software Secured is a leading Penetration Testing as a Service (PTaaS) company, with a head office in beautiful Ottawa, Canada. We help software development teams get ahead of hackers, using a suite of cybersecurity services and products. Software Secured focuses on helping startups, scaleups, and SMBs comply with industry-specific Governance, Risk and Compliance frameworks (SOC 2, ISO27001 & PCI DSS, HIPAA, etc), prove security maturity to enterprise buyers with stringent security requirements and gain peace of mind that their most sensitive company assets have been secured.
The Role
As a Penetration Tester at Software Secured, you will have the opportunity to help our clients secure their mission-critical applications. This includes performing security code review, web, mobile, and network security tests. Help clients with security design reviews, threat modelling, and remediation strategies.
This is a remote, full-time permanent role. However, you must be located in Canada, either a Canadian citizen or a PR holder.
What You'll Do
- Run manual penetration tests across web applications, APIs, mobile apps, and network infrastructure — from scoping through testing, reporting, client readout, and retest
- Produce findings that are manually confirmed and exploitable, with remediation guidance a developer can act on without a follow-up call
- Handle nuanced test cases beyond the standard checklist: business logic flaws, authorization edge cases, vulnerability chaining, and environment-specific attack paths
- Present findings directly to client engineering teams and security leads — explaining what was found, why it matters, and how to fix it
- Contribute to security design reviews and threat modelling engagements earlier in the SDLC
- Mentor junior testers on test execution and report quality; contribute to methodology improvements, tooling, and internal playbooks
- Develop domain depth in one or more service areas (web, network, mobile, code review) through our Domain Expertise Program — with formal recognition and stipend for engineers who build expertise that makes the whole team stronger
Interested in remote work opportunities in QA & Testing? Discover QA & Testing Remote Jobs featuring exclusive positions from top companies that offer flexible work arrangements.
What We're Looking For
- 2+ years of hands-on manual penetration testing — not scanner-assisted, manual
- Demonstrated ability to run standard engagements end-to-end with minimal oversight: scope, test, report, readout, retest
- Finds that go beyond OWASP Top 10 basics — business logic issues, complex auth flaws, chained vulnerabilities
- Reports that are client-ready with low rework: technically accurate, clearly written, correctly risk-rated
- Software development background in one or more of Python, .NET, Ruby, or Java — you understand how the thing was built, not just how to break it
- Strong communication skills in both directions: writing that doesn't require a translator and calls where you can hold your own in front of an engineering team
- Located in Canada and eligible to work (citizen, permanent resident, or valid work visa)
Nice to Have
Browse our curated collection of remote jobs across all categories and industries, featuring positions from top companies worldwide.
- OSCP, OSCP+, or GWAPT
- Experience across multiple service areas (web + mobile, or web + network)
- Familiarity with compliance frameworks that drive our clients' security programs: SOC 2, ISO 27001, PCI DSS, HIPAA
What we are offering:
🤑 Competitive base salary
🍁 Work remotely from anywhere in Canada (you're welcome to work in the Ottawa office when you prefer).
🌍 Work remotely from anywhere in the world for up to 2 months per year.
💰 Yearly profit-sharing between 5 - 12% of your base salary, based on your performance.
💸 Perks such as: monthly UberEats budget, annual home office stipend.
🌴 3 weeks of vacation to start. Additionally, the whole company is off for the week between Christmas and the New Year.
🍼 Parental, bereavement and child loss leave.
🏥 You will receive a comprehensive health benefits package (including dental, vision, and practitioner coverage, among others).
Similar Jobs
Explore other opportunities that match your interests