Location: Hybrid / On-site at client locations as required Offensive Security & Adversary Simulation Malleum is at the forefront of next-generation cyber defense, partnering with marquee clients across space, aerospace, defense, government, financial services, and critical infrastructure. We’re experiencing exceptional growth as demand accelerates for trusted advisors capable of delivering at the intersection of national security, allied intelligence cooperation, and enterprise resilience. Our offensive security consultants test the systems behind cutting-edge defensive technologies, sovereign space capabilities, and allied programs – finding the gaps before adversaries do, on networks that protect missions of genuine national consequence.

If you take pride in breaking things ethically – and helping the most consequential organizations build back stronger – Malleum is where your craft meets purpose. We’re seeking a Penetration Tester to deliver hands-on offensive security engagements across client networks, applications, cloud environments, and operational technology. This is a hands-on consulting role for a practitioner who blends deep technical tradecraft with strong client presence and the discipline to deliver findings clearly, safely, and on schedule.

Plan, scope, and execute penetration tests across external, internal, web application, API, mobile, cloud (Azure / AWS / GCP), wireless, and Active Directory targets Execute social engineering campaigns (phishing, vishing, physical) where contracted, with rigorous rules of engagement Conduct cloud configuration reviews against CIS Benchmarks, CSA CCM,



and provider-specific baselines Support OT / IC S / SCADA security testing for defense and critical-infrastructure clients (with appropriate safety controls) Develop custom tooling, scripts, and payloads (PowerShell, Python, C#, Go) to evade modern EDR and ZTNA controls during sanctioned engagements Produce high-quality client deliverables: executive summaries, technical findings, reproduction steps, evidence, CVSS-scored risk ratings, and pragmatic remediation guidance Contribute to scoping, estimation, statements of work, and continuous improvement of Malleum’s offensive security service offerings Maintain meticulous engagement hygiene: rules of engagement, scope control, evidence handling, and safe-listing coordination 4+ years of professional penetration testing or red team experience, ideally in a consulting, MSSP, or in-house offensive security team ~ Deep working knowledge of network, web application, and Active Directory attack paths (Kerberoasting, AS-REP roasting, NTLM relay, ADCS abuse, BloodHound-driven pathing) ~ Strong scripting skills in Python, PowerShell, and Bash; comfort reading and modifying C#, Go, or Rust tooling ~ Experience evading or bypassing EDR (Defender, CrowdStrike, SentinelOne), AMSI, and modern Windows defenses ~ Familiarity with cloud attack paths in Azure / Entra ID (Pass-the-PRT, illicit consent grants,



managed identity abuse) and AWS (IAM privilege escalation, metadata service abuse) ~ Solid grasp of ZTNA and identity-aware perimeters (e.g., Familiarity with testing standards: Awareness of compliance contexts that frame client expectations: Certifications such as OSCP, OSEP, OSWE, OSCE3, CRTO, CRTL, GPEN, GXPN, GWAPT, GMOB, GCSA / GPCS / GCLD (cloud), AWS Certified Security – Specialty, Microsoft SC-100 / AZ-500 strongly preferred; Willingness and availability to work odd hours and extended shifts when supporting time-boxed red team windows, after-hours testing, or rapid-response offensive support during active IR matters ~ Eligibility for Government of Canada security clearance (Secret or higher); or controlled-goods registration considered an asset ~ Bilingualism (English/French) considered a strong asset Test the systems behind programs with genuine national and allied security impact –across aerospace, defense, and critical infrastructure Join a rapidly scaling firm with a flat, high-trust culture and direct access to senior offensive, IR, and engineering leaders Competitive compensation, performance incentives, and comprehensive perks Continuous learning budget, certification sponsorship (OSCP, OSEP, OSWE, CRTL, SANS), and clear paths into senior red team, exploit development, or offensive research specializations We welcome applications from all qualified candidates and are committed to building a team that reflects the communities and missions we serve. We are proud to accommodate individuals with disabilities throughout the recruitment and selection process.

📌 Remote Penetration Tester - Offensive Security (Ontario)
🏢 Bilinguallink
📍 Ontario