Penetration Testing Analyst

About the role

Sun Life is looking for a skilled Penetration Testing Analyst to perform hands‑on security testing of applications, APIs, mobile platforms and infrastructure. The role focuses on delivering high‑quality penetration testing services while also supporting Red Team and adversary simulation exercises as needed.

Key responsibilities

• Conduct web, API, mobile and infrastructure penetration tests across enterprise applications.
• Identify, exploit and validate vulnerabilities using manual techniques and industry‑standard tools.
• Produce structured reports that detail findings, business impact, risk rating and remediation recommendations.
• Research emerging vulnerabilities, exploits and attack techniques to broaden testing coverage.
• Support re‑testing activities to confirm remediation of identified issues.
• Assist in Red Team or adversary simulation exercises, including reconnaissance, attack‑surface mapping and controlled exploitation under guidance.

Required profile

• Hands‑on experience with web application security testing (OWASP Top 10) and API security testing.
• Basic network/infrastructure testing knowledge.
• Strong understanding of authentication, session management, access‑control flaws, input validation and injection vulnerabilities.
• Ability to perform manual testing beyond automated scanning.
• Excellent documentation and reporting skills with clear risk articulation.

Required skills

• Burp Suite
• Nmap
• sqlmap (or similar)
• Manual exploitation techniques
• Documentation and reporting tools