search Browse Jobs
Offensive Security Consultant ( Penetration Testing)CGI · Toronto, Ontario, Canada
CGI logo

CGI

company page ↗

Offensive Security Consultant ( Penetration Testing)

🗓️ Posted 2026-09-06 Toronto, Ontario, Canada Full-time Hybrid ICT
💰 Salary 7,917 CAD–12,083 CAD/mo (95,000 CAD–145,000 CAD/yr) 📊 Market 7,000 CAD–12,000 CAD/mo

About the Company

Insights you can act on. Founded in 1976, CGI is among the largest IT and business consulting services firms in the world. We are insights-driven and outcomes-focused to help accelerate returns on your investments. Across hundreds of locations worldwide, we provide comprehensive, scalable and sustainable IT and business consulting services that are informed globally and delivered locally. We value your opinions and welcome your comments and questions on our posts here on LinkedIn. Please keep a polite, professional and constructive tone. We remove comments containing objectionable language and derogatory views. We do not allow content that is unrelated to the subject, and we remove discriminatory and racist comments as well as spam and advertising. Note that content on this page contains general information regarding CGI's services and initiatives and should not be considered direct business advice. To engage in a discussion with one of our experts, please make a request through https://www.cgi.com/en/contact-us IT Services and IT Consulting Specialties: artificial intelligence, ai, business consulting, business process services, cloud, digital transformation, emerging technology, energy transition, information technology, innovation, intellectual property, IP, managed it, managed services, supply chain, systems integration

About the Role

We are seeking an experienced Penetration Tester / Offensive Security Consultant to assess the security posture of applications, infrastructure, cloud environments, and network systems through authorized penetration testing and security assessments. The successful candidate will identify exploitable vulnerabilities, evaluate potential business impact, and provide actionable remediation recommendations to strengthen the organization's overall security posture. The role requires strong hands-on technical expertise, an understanding of modern attack techniques, and the ability to communicate complex security findings clearly to both technical and non-technical stakeholders.

Responsibilities

  • ● Plan and execute authorized penetration testing engagements across internal and external environments.
  • ● Conduct network, infrastructure, web application, API, wireless, and cloud security testing, as required.
  • ● Perform vulnerability identification, validation, and controlled exploitation to assess potential security impact.
  • ● Assess authentication, authorization, session management, access controls, and security configurations.
  • ● Identify vulnerabilities arising from misconfigurations, insecure implementations, weak security controls, and architectural weaknesses.
  • ● Evaluate security controls designed to prevent, detect, and respond to potential attacks.
  • ● Perform manual testing to validate automated vulnerability scanning results and identify vulnerabilities that automated tools may not detect.
  • ● Conduct penetration testing of web and mobile applications and APIs.
  • ● Assess applications against recognized security standards and methodologies, including OWASP Top 10 and OWASP API Security Top 10.
  • ● Evaluate common application security risks, including injection vulnerabilities, broken access controls, authentication weaknesses, insecure configurations, and business logic vulnerabilities.
  • ● Review application attack surfaces and identify potential pathways that could lead to unauthorized access or data exposure.
  • ● Perform security assessments of internal and external network infrastructure.
  • ● Evaluate operating systems, network devices, security appliances, and exposed services.
  • ● Conduct penetration testing of cloud environments, where authorized, including Microsoft Azure, AWS, and Google Cloud Platform.
  • ● Assess identity and access management configurations, cloud permissions, exposed resources, and potential privilege escalation paths.
  • ● Evaluate Active Directory and enterprise identity environments for security weaknesses and potential attack paths.
  • ● Analyze identified vulnerabilities to determine exploitability, severity, and potential business impact.
  • ● Prioritize findings based on technical risk, business context, and likelihood of exploitation.
  • ● Apply industry-standard vulnerability scoring methodologies, including CVSS, where appropriate.
  • ● Resarch emerging vulnerabilities, attack techniques, and threat trends relevant to the organization's technology environment.
  • ● Develop clear and comprehensive penetration testing reports documenting methodology, findings, evidence, risk ratings, business impact, and recommended remediation actions.
  • ● Provide executive-level summaries for senior management and detailed technical findings.

Requirements

  • ● Strong hands-on technical expertise.
  • ● Understanding of modern attack techniques.
  • ● Ability to communicate complex security findings clearly to both technical and non-technical stakeholders.