Penetration Testing Specialist

Required Skills:

Mandatory Qualifications & Experience Candidates must meet the following requirements: 1. Penetration Testing Experience Minimum 3 years of professional experience in penetration testing. Demonstrated experience conducting penetration testing on digital systems. Experience with application security testing and vulnerability identification. 2. Tier 1 Certification Mandatory at Team Level At least one proposed resource must hold a recognized Tier 1 certification: Offensive Security Certified Penetration Tester (OSCP) OR CREST Registered Penetration Tester (CRT). 3. Tier 2 Certification Mandatory at Team Level At least one proposed resource must hold a recognized Tier 2 certification: Certified Ethical Hacker Master (CEH-Master) OR GIAC Penetration Tester (GPEN) OR CompTIA PenTest. 4. Public Sector Penetration Testing Experience Proven experience conducting penetration testing for the Canadian public sector including federal provincial territorial and/or municipal government organizations. 5. Government of Nova Scotia Experience Experience conducting penetration testing for the Government of Nova Scotia is required as part of the stated experience requirements. 6. Recent Penetration Testing Experience At least one proposed resource must have conducted two (2) or more penetration tests within the last 12 months. 7. Cross-Functional Collaboration Demonstrated ability to work effectively with IT cybersecurity application teams and business stakeholders. 8. Criminal Record Check A clear criminal record check processed within the last six (6) months must be provided for each proposed resource. Required Technical Testing Scope Experience should align with the SOWs defined penetration-testing scope including: Web Application Penetration Testing API Security / API Penetration Testing Grey Box Testing Black Box Testing Vulnerability identification and analysis Security assessment and risk analysis CVSS-based vulnerability severity assessment Penetration testing reporting Remediation validation and re-testing Testing Methodologies Grey Box Testing Testing with partial knowledge of the target environment such as credentials or system documentation simulating an attacker with some level of access. Black Box Testing Testing with no prior knowledge of the target environment simulating an external attacker using reconnaissance and trial-and-error techniques. Key Deliverables The successful resource will contribute to: Final Penetration Testing Report Scope and objectives Testing methodologies and tools Detailed vulnerabilities and findings Severity ratings Affected systems Potential impacts Recommended treatment/remediation plans Remediation timelines Executive Presentation Major findings Vulnerabilities Potential impacts Recommended mitigations Business-level summary for non-technical stakeholders Remediation Validation Re-test identified vulnerabilities Verify remediation effectiveness Document validation results Proposal / Submission Requirements For each proposed resource suppliers should be prepared to provide: Resume/CV Years and types of penetration testing experience Relevant penetration testing project examples from the past five years Tier 1 certification details where applicable Tier 2 certification details where applicable Public-sector penetration testing experience in Canada Government of Nova Scotia experience Evidence of at least two penetration tests completed within the past 12 months for at least one proposed resource Clear criminal record check completed within the last six months

Required Education:

Bachelors Degree in Computer Science Information Technology Cybersecurity or a related cybersecurity / penetration testing training and certifications CREST CRT CEH-Master GPEN or CompTIA PenTest certifications are highly relevant.