Penetration Testing Consultant

Overview

Join a team where your work goes beyond checklists protecting critical financial applications with real business and regulatory impact.

High‑impact, meaningful work: Directly influence the security of applications that matter to customers, regulators, and the business. Focus on deep, manual penetration testing (web, mobile, APIs) rather than automated assessments. Accelerated technical growth in complex, enterprise‑scale environments. End‑to‑end ownership across the full lifecycle: scoping, testing, reporting, remediation. Modern tools and techniques to enhance depth and efficiency. Fewer, higher‑quality engagements.

Key Skills

• 3+ years of manual penetration testing experience in web or API.
• Solid grasp of HTTP/S protocols, headers, cookies, sessions, and CORS.
• Experience testing authentication and authorization mechanisms: OAuth, JWT, session flaws, IDOR/BOLA.
• Proficiency with Burp Suite Professional, OWASP ZAP, IBM APP SCAN.
• Deep practical knowledge of OWASP Top 10 (Web + API) and common vulnerabilities.
• Ability to identify and exploit business logic vulnerabilities and multi‑step attack paths.
• At least one relevant information‑security certification (OSCP, GMOB, GWAPT, OSWE, (ISC)², ISACA, SANS).
• Secure coding and architecture understanding.
• Proficiency in at least one scripting language.
• Strong documentation skills for reproducible findings.

Core Responsibilities

• Provide information‑security consulting services for BMO and its business groups.
• Understand business vision, objectives, and KPIs; identify risks and opportunities.
• Explain core processes, risks, and mitigation techniques to stakeholders.
• Develop and champion information‑security best practices; stay abreast of industry trends.
• Facilitate discussions and manage initiatives using disciplined elicitation and documentation techniques.
• Recommend solutions based on frameworks, standards, and regulatory requirements.
• Support execution of strategic initiatives with internal and external stakeholders.
• Track metrics and milestones; provide recommendations and escalation as needed.
• Assist with continuous improvement, root‑cause analysis, and documentation of insights.
• Deliver professional presentations and concise reports.

Qualifications

• 4–7 years of relevant experience and a post‑secondary degree in Information Security, Computer Science, Engineering, or a related field.
• Strong knowledge of NIST CSF, ISO 27001/27002, PCI DSS, and other industry frameworks.
• Experience in information‑security concepts, methodology, processes, and controls.
• Knowledge of business analysis, project delivery practices, and risk management.
• Proficient verbal and written communication; collaboration and influence skills; analytic problem‑solving.
• Data‑driven decision making.

Salary and Benefits

Salary : $82,800.00 – $154,800.00 (salaried). Salaries will vary based on location, skills, experience, education, and qualifications. BMO offers performance‑based incentives, discretionary bonuses, health insurance, tuition reimbursement, accident and life insurance, and retirement savings plans. For more details of our benefits, please visit

Accommodations and Equal Opportunity

BMO is committed to an inclusive, equitable and accessible workplace. Accommodations are available on request for candidates taking part in all aspects of the selection process. To request accommodation, please contact your recruiter.

Contact and Recruitment Policy

Note to recruiters: BMO does not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to BMO, directly or indirectly, will be considered BMO property. A recruiting agency must first have a valid, written and fully executed agency agreement contract for service to submit resumes. For more information, visit