Client: Government of Nova Scotia – Service Nova Scotia (GeoNOVA)

Project: Infrastructure Registry for Municipal Assets (IRMA) Application Penetration Testing

Work Arrangement: Remote; office space in Halifax or Amherst may be available if required and mutually agreed upon

Contract: November 2, 2026 – November 27, 2026

Openings: 1

Engagement Type: Competitive-Sourced

Payment Structure: Milestone

Project Overview

The Government of Nova Scotia is seeking an Intermediate Penetration Testing Specialist to conduct security testing of the Infrastructure Registry for Municipal Assets (IRMA), a provincially supported, web-based GIS application hosted within the Nova Scotia Geospatial Infrastructure (NSGI).

The successful resource will perform penetration testing using Grey Box and Black Box methodologies, identify and analyze vulnerabilities, validate security controls, document findings, provide remediation recommendations, and re-test identified vulnerabilities following remediation.

Key Responsibilities

- Conduct penetration testing of the IRMA web application using the required testing methodologies.

- Perform Grey Box and Black Box penetration testing based on the approved scope and testing plan.

- Assess the security of the web application and applicable APIs within the defined scope.

- Identify, analyze, evaluate, and document security vulnerabilities using industry best practices.

- Review and analyze relevant penetration testing results and security scan results from the IRMA application and related systems.

- Assess vulnerabilities, severity, affected systems, potential business/technical impacts, and recommended remediation actions.

- Immediately report Critical vulnerabilities, as identified using the Common Vulnerability Scoring System (CVSS), to the Cyber and Risk team and Service Nova Scotia (GeoNOVA).

- Participate in project kickoff, progress/status meetings, and security risk assessment activities as required.

- Work collaboratively with IT, cybersecurity, application owners, and business stakeholders.

- Identify appropriate business owners and risk treatment owners for penetration testing recommendations.

- Provide weekly status updates throughout the engagement.

- Prepare a comprehensive Final Penetration Testing Report.

- Prepare and deliver an Executive Presentation summarizing key findings, vulnerabilities, impacts, and recommended mitigations.

- Re-test and verify remediation of findings identified during the penetration testing engagement.

- Ensure all testing tools and toolkits are used in accordance with Government of Nova Scotia requirements.

- Obtain prior written approval before installing any testing toolkit on the Government of Nova Scotia network.

- Thoroughly remove all testing-related files, binaries, scripts, backdoors, malware, and other related items following testing.

Requirements

Mandatory Qualifications & Experience

Candidates must meet the following requirements:

- Minimum 3 years of skilled experience in penetration testing.

- Demonstrated experience conducting penetration testing on digital systems.

- Experience with application security testing and vulnerability identification.

2. Tier 1 Certification – Mandatory at Team Level

At least one proposed resource must hold a recognized Tier 1 certification:

- Offensive Security Certified Penetration Tester (OSCP), OR

- CREST Registered Penetration Tester (CRT).

3. Tier 2 Certification – Mandatory at Team Level

At least one proposed resource must hold a recognized Tier 2 certification:

- Certified Ethical Hacker Master (CEH-Master), OR

- Proven experience conducting penetration testing for the Canadian public sector, including federal, provincial, territorial, and/or municipal government organizations.

5. Government of Nova Scotia Experience

- Experience conducting penetration testing for the Government of Nova Scotia is required as part of the stated experience requirements.

- At least one proposed resource must have conducted two (2) or more penetration tests within the last 12 months.

7. Cross-Functional Collaboration

- Demonstrated ability to work effectively with IT, cybersec

📌 Sales and Benefits Specialist (Cole Harbour)
🏢 HMG Careers
📍 Cole Harbour