ABOUT STINGRAI
Stingrai is a CREST-accredited premier offensive security firm specializing in expert-led penetration testing. Headquartered in Toronto, Canada, with a European hub in London, UK, we serve a global client base across Canada, the US, and Europe, from high-growth SaaS and fintech startups to large enterprises.
We are on a mission to transform offensive security. Alongside a team of experienced penetration testers, we operate an agentic penetration testing as a service (PTaaS) platform that delivers autonomous penetration testing, powered by Snipe, our AI pentesting agent, along with expert human pentesters. The result is world-class, real-world security validation that keeps pace with how fast modern environments change.
We are a team of security researchers, exploit developers and penetration testers. Our team holds the industry's most rigorous certifications, including OSCE³, OSCP, OSWE, and OSEP, has published dozens of CVEs, and presents research at conferences including DEF CON, BSides, and NATO Locked Shields.
THE ROLE
We are hiring a Penetration Tester on a 6 month contract, with potential to convert to a permanent full-time position within 3 to 6 months. This is a hands-on role for someone who already have experience in web application, API, and network penetration testing.
The role is hybrid and based in Toronto, with 2 to 3 days per week in our office. Roughly 10 to 20 percent of engagements also require onsite presence at client sites in the Greater Toronto Area.
WHAT YOU'LL DO
- Plan and execute penetration tests across web applications, APIs, and internal and external networks
- Dig into every finding until you have proven real, exploitable impact, then document it with clear, prioritized remediation guidance
- Validate and triage findings from Snipe, our AI pentesting agent, applying human judgment to separate real risk from noise
- Where it matters, chain application flaws into adjacent areas such as cloud or Active Directory to demonstrate full impact
- Write professional reports and debrief findings to both technical teams and executives
- Work directly with clients through our PTaaS platform, including live support during active engagements
- Keep current with new attack techniques, tooling, and disclosed vulnerabilities, and bring what you learn back to the team
- Participate in our research and development (R&D) initiatives to further enhance our offensive security solutions, publish security blogs, and contribute back to the community
WHO YOU ARE
- You think like an attacker. You are not satisfied flagging a vulnerability. You prove its impact.
- You communicate clearly and on time, with clients, project leads, and teammates alike.
- You take ownership of your work. Your name is on every report you deliver, and it shows.
- You go toward hard problems, not around them, and you adapt fast in client environments.
- You keep learning, because offensive security changes constantly.
- You leave the ego at the door. The strongest finding wins, whoever surfaces it.
MINIMUM REQUIREMENTS
- OSCP certification
- 2 to 3 years of hands-on experience in web application, API, and network penetration testing
- Strong grasp of OWASP Top 10 and common attack techniques across web, API, and network
- Based in Toronto, Canada, and available for onsite presence at client sites for certain engagements
- Legally authorized to work in Canada without restrictions
We do not offer sponsorship for this role.
PREFERRED QUALIFICATIONS
These are not required, but will strengthen your application:
- Experience in a consulting or client-facing role
- Red teaming and adversary simulation
- Physical perimeter security
- Wi-Fi security testing
- Social engineering and phishing
- Cloud security across AWS, Azure, or GCP
- Secret clearance, or eligibility to obtain one
- A bug bounty track record
- Published security research, such as CVEs or conference talks
WHY STINGRAI
- A clear path from contract to permanent, with real room to grow your craft
- Work alongside an elite team of top bug bounty hunters, OSCE³ certified senior penetration testers, dozens of published CVEs, and talks at DEF CON, BSides, and NATO Locked Shields
- Test real targets for a global client base across Canada, the US, and Europe, from high-growth startups to large enterprises
- Use and help shape our agentic PTaaS platform and Snipe, our AI pentesting agent, instead of grinding through checklists
- A clear path from contract to permanent for the right person
- Competitive compensation and real room to grow your craft
COMPENSATION
- Conversion to a permanent full-time position with salary and benefits within 3 to 6 months, based on performance during the contract term
HOW TO APPLY
Apply through LinkedIn with your resume. A cover letter is optional. Applications sent by email will not be reviewed.
We use AI-assisted tools, including LinkedIn's AI interview, to help screen and assess applications. A human reviews every shortlisted candidate.
