Penetration Testing Analyst

About the role

Sun Life is looking for a Penetration Testing Analyst to perform hands‑on security testing of applications, infrastructure and systems. The role focuses on delivering penetration testing engagements while also supporting Red Team and adversary simulation activities as needed.

Key responsibilities

• Conduct web, API, mobile and infrastructure penetration tests across enterprise applications.
• Identify, exploit and validate security vulnerabilities using manual techniques and industry‑standard tools.
• Follow established methodologies and frameworks such as OWASP.
• Produce clear reports that detail findings, business impact, risk rating and remediation recommendations.
• Research emerging vulnerabilities, exploits and attack techniques to broaden testing coverage.
• Support re‑testing to confirm remediation of identified issues.
• Assist Red Team or adversary simulation exercises, including reconnaissance, attack‑surface mapping and controlled exploitation under guidance.

Required profile

• Hands‑on experience with web application, API and basic network/infrastructure security testing.
• Strong understanding of authentication, session management, access‑control, input validation and injection flaws.
• Ability to perform manual testing beyond automated scanning.
• Excellent documentation and reporting skills with a focus on clear risk articulation.

Required skills

• Web application security testing (OWASP Top 10)
• API security testing
• Network/infrastructure testing
• Authentication, session management and access‑control assessment
• Input validation and injection vulnerability analysis
• Tools: Burp Suite, Nmap, sqlmap (or similar)
• Manual exploitation techniques and limited post‑exploitation validation