Penetration Testing Lead (Contract)

ascio is hiring a Penetration Testing Lead to support our offensive security and penetration testing work across networks, applications, APIs, cloud environments and identity platforms.

This role will plan, perform and report penetration tests using a documented methodology and agreed rules of engagement, and will validate remediation through retesting.

Responsibilities

1. Scope external, internal, web application, API, cloud and wireless penetration tests and define appropriate rules of engagement.
2. Perform reconnaissance, vulnerability discovery, manual exploitation and post-exploitation activities within agreed limits.
3. Coordinate additional testers where required.
4. Prepare detailed technical reports including reproduction steps, supporting evidence, severity ratings and remediation guidance.
5. Prepare executive summaries and present findings to technical teams and management.
6. Retest remediated findings and document closure or remaining risk.

Required Skills and Experience

1. Six or more years of experience in penetration testing or offensive security.
2. Strong experience conducting external and internal network penetration testing, including segmentation testing and lateral movement.
3. Web application and API testing experience using the OWASP Web Security Testing Guide and OWASP API Security Top 10.
4. Active Directory and Microsoft Entra ID attack path analysis, privilege escalation and identity security testing.
5. Cloud configuration and identity testing experience in Microsoft Azure or AWS.
6. Strong manual vulnerability validation and exploitation skills, beyond automated scanner output.
7. Hands-on experience with tools such as Burp Suite Professional, Nmap, Metasploit, BloodHound, Impacket and Nessus.
8. Demonstrated ability to conduct testing safely in production environments and securely handle sensitive evidence and test data.
9. Strong written and verbal communication skills, with the ability to explain technical findings clearly to both technical and non-technical audiences.

Qualifications

1. One or more current hands-on penetration testing certifications such as OSCP, CREST CRT, CREST CCT, GPEN or an equivalent recognized certification.
2. Applicants must be able to provide certification status and expiry dates, where applicable.
3. Degree or diploma in computer science, cybersecurity or a related field, or equivalent professional experience.
4. OSEP, OSCE, OSWE, CRTO, GWAPT, GXPN or CISSP are considered assets.

Preferred Experience

1. Red team or adversary emulation engagements.
2. Mobile application testing across iOS and Android.
3. Secure code review.
4. Wireless security testing.
5. Social engineering and phishing simulation.

Location and Work Arrangement

1. Remote within Canada.
2. Some assignments may require occasional onsite work or travel within Canada.
3. Applicants must be based in Canada and legally entitled to work in Canada.
4. A criminal record check may be required before access to sensitive systems, information or environments.