AI Penetration Tester

Job Description: - Conduct security assessments of AI systems, LLMs, AI agents, and machine learning applications

• Perform adversarial testing including prompt injection, jailbreaks, model manipulation, and abuse-case testing
• Execute application, API, and cloud security testing for AI-enabled solutions
• Develop repeatable AI security testing methodologies, tools, and automation
• Partner with development and engineering teams to validate and remediate findings
• Produce technical reports and executive summaries communicating risks and recommendations
• Research emerging AI threats and attack techniques
• Support red team exercises involving AI-enabled attack scenarios
• Provide analysis and reporting services for business groups and BMO
• Build stakeholder relationships, understand problems and opportunities, and recommend solutions
• Analyze data and create documents and plans for internal stakeholders
• Participate in or conduct user acceptance testing
• Provide customer service supporting information security processes, applications, and infrastructure
• Provide strategic input as a trusted advisor and specialized analytical support to senior management
• Act as a subject matter expert on regulations, policies, and information security
• Present and communicate across IT and business units; prepare presentations for senior leaders
• Lead preparation of end-user reference and training materials
• Work with vendors to troubleshoot issues as required
• Troubleshoot information security issues within designated business groups
• Gather and document requirements for audits, reports, and projects
• Facilitate requirements discussions and manage requirements through structured analysis
• Collect, organize, analyze, and disseminate information; identify trends and data-quality issues
• Develop data-collection systems and strategies
• Maintain process, procedure, and requirements documentation
• Recommend approaches to streamline and integrate information security processes
• Monitor emerging information security technologies and threats and determine mitigation approaches
• Support technical development, mentoring, communities of practice, and information-security networks
• Apply BMO's Risk Management Framework and make risk-informed decisions aligned with policies, laws, and regulations
• Broader work or accountabilities may be assigned as needed

Requirements: - Typically 7+ years of relevant experience

• Post-secondary degree in Information Security, Computer Science, Engineering, Information Systems, Business, or a related field, or equivalent combination of education and experience
• Multiple Information Security certifications from a well-recognized institution (e.g. (ISC)2, ISACA, SANS)
• Expert information security, technology, business requirements gathering, and reporting experience in a financial services setting
• Expert data manipulation and analysis skills
• Expert knowledge of Information Security processes, procedures, and controls
• Expert understanding and problem-solving ability regarding Information Security issues across the bank
• Expert understanding of NIST Cyber Security Framework (CSF), ISO 27001, and ISO 27002
• In-depth understanding of Information Security risk and regulatory requirements
• Understanding of computing-environment complexity and security-platform impacts
• In-depth/expert verbal and written communication skills
• In-depth/expert analytical and problem-solving skills
• In-depth/expert influence skills
• In-depth/expert collaboration and team skills
• Ability to manage ambiguity
• In-depth/expert data-driven decision-making skills
• Advanced penetration testing experience across web applications, APIs, and cloud environments
• Hands-on experience assessing AI/LLM technologies, AI agents, ML models, or GenAI applications
• Strong understanding of offensive security methodologies and adversarial attack techniques
• Experience with Python scripting and security tool development/automation
• Knowledge of OWASP Top 10, API Security Top 10, and emerging OWASP LLM Security risks
• Experience performing threat modeling and security assessments
• Strong understanding of authentication, authorization, identity, and cloud security concepts
• Ability to clearly document findings and remediation recommendations
• Work remotely in the USA within EST or CST time zones

Benefits: - Health insurance

• Tuition reimbursement
• Accident and life insurance
• Retirement savings plans
• Performance-based incentives
• Discretionary bonuses
• In-depth training and coaching
• Manager support
• Network-building opportunities
• Reasonable accommodations for individuals with disabilities