Location: Hybrid / In office at client locations as requiredDepartment: Offensive Security & Adversary SimulationAbout MalleumMalleum is at the forefront of next-generation cyber defense, partnering with marquee clients across space, aerospace, defense, government, financial services, and critical infrastructure. We're experiencing exceptional growth as demand accelerates for trusted advisors capable of delivering at the intersection of national security, allied intelligence cooperation, and enterprise resilience. Our offensive security consultants test the systems behind cutting-edge defensive technologies, sovereign space capabilities, and allied programs - finding the gaps before adversaries do, on networks that protect missions of genuine national consequence.If you take pride in breaking things ethically - and helping the most consequential organizations build back stronger - Malleum is where your craft meets purpose.The OpportunityWe're seeking a Penetration Tester to deliver hands-on offensive security engagements across client networks, applications, cloud environments, and operational technology. You'll work directly within client environments - including sovereign, regulated, and cleared settings - emulating real-world adversaries, documenting findings, and partnering with clients to drive meaningful remediation.This is a hands-on consulting role for a practitioner who blends deep technical tradecraft with strong client presence and the discipline to deliver findings clearly, safely, and on schedule.What You'll DoPlan, scope, and execute penetration tests across external, internal, web application, API, mobile, cloud (Azure / AWS / GCP), wireless, and Active Directory targetsConduct red team and adversary emulation engagements aligned to MITRE ATT&CK, executing realistic TTPs against client environmentsPerform assumed-breach assessments, internal pivoting, privilege escalation, and lateral movement exercisesSupport purple team exercises in partnership with client SOC and Malleum's IR practice to improve detection and responseExecute social engineering campaigns (phishing, vishing, physical) where contracted, with rigorous rules of engagementConduct cloud configuration reviews against CIS Benchmarks, CSA CCM, and provider-specific baselinesSupport OT / ICs / SCADA security testing for defense and critical-infrastructure clients (with appropriate safety controls)Develop custom tooling,



scripts, and payloads (PowerShell, Python, C#, Go) to evade modern EDR and ZTNA controls during sanctioned engagementsProduce high-quality client deliverables: executive summaries, technical findings, reproduction steps, evidence, CVSS-scored risk ratings, and pragmatic remediation guidanceDeliver findings briefings to client stakeholders - from engineers to executive leadership and boards - with clarity and professionalismContribute to scoping, estimation, statements of work, and continuous improvement of Malleum's offensive security service offeringsMaintain meticulous engagement hygiene: rules of engagement, scope control, evidence handling, and safe-listing coordinationParticipate in research, internal tooling development, CTFs, and conference contributions to grow Malleum's offensive capability and brandWhat You Bring4+ years of professional penetration testing or red team experience, ideally in a consulting, MSSP, or in-house offensive security teamDemonstrated success working directly with clients - strong communication, professionalism, and stakeholder management skillsDeep working knowledge of network, web application, and Active Directory attack paths (Kerberoasting, AS-REP roasting, NTLM relay, ADCS abuse, BloodHound-driven pathing)Hands-on proficiency with offensive tooling: Burp Suite Pro, Nmap, Nessus / Nuclei, Metasploit, Cobalt Strike, Sliver, Mythic, Impacket, BloodHound, CrackMapExec / NetExec, Responder, Mimikatz, and modern C2 frameworksStrong scripting skills in Python, PowerShell, and Bash; comfort reading and modifying C#, Go, or Rust toolingExperience evading or bypassing EDR (Defender, CrowdStrike, SentinelOne), AMSI, and modern Windows defensesFamiliarity with cloud attack paths in Azure / Entra ID (Pass-the-PRT, illicit consent grants, managed identity abuse) and AWS (IAM privilege escalation, metadata service abuse)Solid grasp of ZTNA and identity-aware perimeters (e.G., Cloudflare Access, Zscaler, Entra Conditional Access)



and how they reshape attacker tradecraftComfort emulating adversary TTPs mapped to MITRE ATT&CK and known threat-actor playbooksFamiliarity with testing standards: PTES, OWASP WSTG / MASTG / ASVS, NIST SP 800-115, OSSTMMAwareness of compliance contexts that frame client expectations: PCI DSS, SOC 2, NIST 800-171 / CMMC, CPCSC, ITSG-33, ISO 27001:2022Certifications such as OSCP, OSEP, OSWE, OSCE3, CRTO, CRTL, GPEN, GXPN, GWAPT, GMOB, GCSA / GPCS / GCLD (cloud), AWS Certified Security - Specialty, Microsoft SC-100 / AZ-500 strongly preferred; OSCP or equivalent practical certification (e.G., CRTO, HTB CPTS, PNPT) is a baseline expectationDemonstrated ability to perform under pressure - calm, methodical, and ethical when engagements surface sensitive findingsWillingness and availability to work odd hours and extended shifts when supporting time-boxed red team windows, after-hours testing, or rapid-response offensive support during active IR mattersComfort working across multiple client environments, tooling stacks, and rules-of-engagement simultaneouslyEligibility for Government of Canada security clearance (Secret or higher); existing clearance highly valued; or controlled-goods registration considered an assetBilingualism (English/French) considered a strong assetWhy MalleumTest the systems behind programs with genuine national and allied security impact - across aerospace, defense, and critical infrastructureJoin a rapidly scaling firm with a flat, high-trust culture and direct access to senior offensive, IR, and engineering leadersExposure to a wide variety of advanced targets, sectors, and cleared environmentsDedicated research time, lab budget, and support for conference talks, CVE research, and open-source contributionsCompetitive compensation, performance incentives, and comprehensive benefitsContinuous learning budget, certification sponsorship (OSCP, OSEP, OSWE, CRTL, SANS), and clear paths into senior red team, exploit development, or offensive research specializationsMalleum is an equal opportunity employer. We welcome applications from all qualified candidates and are committed to building a team that reflects the communities and missions we serve.We are proud to accommodate individuals with disabilities throughout the recruitment and selection process. Please indicate your need for accommodations in your application.

📌 Remote Penetration Tester - Offensive Security (Terrebonne)
🏢 Bilinguallink
📍 Terrebonne