Bug Bounty Program Jobs in Ontario (NOW HIRING)

About the Role 

We're looking for a hands-on Director of Offensive Security to lead and evolve our offensive security program across applications, cloud environments, enterprise systems, and AI-enabled products. 

This role combines technical expertise, strategic leadership, and cross-functional partnership to help identify, prioritize, and reduce security risk at scale. You'll lead offensive security initiatives including penetration testing, red teaming, AI security validation, vulnerability management, and bug bounty programs while partnering closely with Engineering, Product, Security, Compliance, and Legal teams. 

What You'll Do 

Lead the Offensive Security Program 

• Define and execute the offensive security strategy and roadmap.  

• Lead internal and external teams across penetration testing, red teaming, AI security testing, and vulnerability research.  

• Establish standards, reporting, and metrics that drive measurable risk reduction.  

Drive Security Testing & Validation 

• Oversee web, API, mobile, cloud, and AI-enabled security testing.  

• Lead red team operations, adversary simulations, and purple team exercises.  

• Manage external penetration testing engagements and testing vendors.  

• Mature attack surface management and continuous security validation programs.  

Secure AI-Enabled Products 

• Design and execute AI red teaming activities for LLM-enabled products and agentic workflows.  

• Partner with AI and engineering teams to integrate security throughout the AI development lifecycle.  

• Build scalable approaches for AI security testing, validation, and risk assessment.  

Improve Vulnerability Management 

• Drive vulnerability triage, prioritization, remediation, and retesting.  

• Partner with engineering teams to implement risk-based remediation practices.  

• Mature bug bounty and vulnerability disclosure programs.  

Influence Across the Business 

• Partner with Engineering, Product, Security Operations, Compliance, and Legal teams.  

• Communicate security risks, trends, and recommendations to senior leadership.  

• Help shape the future of AI-enabled offensive security across the organization.  

What You'll Bring 

• 10+ years of Information Security experience, including 5+ years in Offensive Security and 3+ years in Development or Engineering.  

• Experience leading offensive security programs in SaaS and cloud environments.  

• Hands-on expertise in penetration testing, red teaming, vulnerability management, and security testing of AI-enabled products.  

• Strong understanding of application security, cloud security, attack surface management, and secure development practices.  

• Experience working with modern cloud environments, APIs, web applications, containers, and AI/LLM technologies.  

• Ability to translate technical findings into business risk and influence stakeholders at all levels.  

• Relevant certifications such as OSCP, OSWE, GXPN, GPEN, CISSP, CCSP, or cloud security certifications are considered an asset.  

What Success Looks Like 

First 90 Days 

• Assess the current offensive security landscape and identify key opportunities for improvement.  

• Build relationships across engineering, security, and business teams.  

• Establish priorities and define a roadmap for continuous security validation.  

6+ Months 

• Scale AI-enabled offensive security capabilities.  

• Improve vulnerability management effectiveness and remediation outcomes.  

• Deliver measurable reductions in organizational security risk. 

Long-term (7+ months): Mature, Measure & Reduce Risk 

• Scale autonomous vulnerability management across critical assets and environments.