Penetration Testers and Red Teamers: Finding Consulting Work in Canada
You’re on a call with a Toronto-based security consultancy that hires penetration testers on contract. They like your CV and your OSCP, and then they ask: “Are you set up to bill us as a contractor, or do you need us to sponsor a work permit?” It’s the question that decides whether this turns into consulting work or nothing.
Q: Is penetration testing a licensed profession in Canada?
No. Cybersecurity roles, including penetration testing, sit inside the roughly 80% of Canadian occupations that are unregulated — no licensing college, no mandatory exam, no protected title. Government of Canada’s Foreign Credential Recognition Tool is the way to check regulation status for any occupation province by province, and it’s worth running before you assume anything either way. What that means practically: a Canadian employer or consultancy decides who they hire based on your track record, your certifications and how you interview — not on a government body approving you first. One caveat worth flagging: if your title leans toward “security engineer,” some provinces protect the word “engineer” for licensed professional engineers. It rarely bites cybersecurity roles in practice, but it’s worth knowing the caveat exists before you put “engineer” on a business card.
Q: Does an OSCP certification carry weight with Canadian employers?
Almost certainly, in the sense that Canadian security teams hire on demonstrated, hands-on capability — but there’s no research confirming a specific “value” figure, a formal Canadian body that ranks certifications, or a documented reciprocity arrangement for OSCP or CISSP-style credentials. Treat any number you see quoted online (“OSCP holders earn X% more”) with suspicion unless it’s sourced. The honest version: bring the certification, bring a portfolio of work you can actually discuss, and let the interview do the rest.
Q: What about scope and legal authorisation for engagements — does that change across a border?
This is the part to take seriously and the part where general blog advice, including this one, runs out. Authorisation to test a system, and the legal exposure if a scope boundary gets crossed, is contract and criminal law territory that varies by jurisdiction and by client. If you’re going to be running engagements against Canadian infrastructure — whether you’re resident in Canada or working cross-border from South Africa — that’s a conversation for a lawyer who knows Canadian computer-misuse and contract law rather than a generalist immigration source. Get the authorisation letter in writing, every time, and have someone qualified look at the engagement contract before your first job.
Q: Report writing keeps coming up as a skill gap. Is that real?
It shows up constantly in how the industry talks about itself, but there’s no Canada-specific data in front of us to quantify it. What’s reasonable to say: consultancies bill clients for a deliverable, and the deliverable is the report, not the exploit chain. If your English writing is strong and your findings are structured for a non-technical reader as well as a technical one, that’s a genuine differentiator regardless of which country you’re testing in.
Q: Where do red team consultancies actually sit — in-house or agency?
Both exist in the Canadian market — banks, insurers and larger tech firms increasingly run internal red teams, and a boutique consultancy sector serves clients who don’t. We don’t have a breakdown of how that splits by city or sector, so don’t take a specific ratio from this post; use it as a starting framework for what to search for rather than a market map.
None of this is legal or immigration advice on your specific situation — a licensed RCIC or immigration lawyer is the right call once you have an actual offer in hand. Cape2Canada’s guides cover the general work-permit landscape if you want the broader groundwork first.