Global Secrets Platform Engineer (Vault & Zero-Trust)

Randstad Canada; Vancouver; Hybrid; CAD 140,000 - 170,000; Full time

Job summary

Randstad Canada is seeking a Platform Engineer to design and operate a global, cryptographic secrets infrastructure. You will implement zero-trust access, dynamic secrets, and JIT provisioning across multi-region cloud environments, integrating with GitLab pipelines and IaC tools.

The role emphasizes high availability, compliance, and automation, including plugin development and policy-as-code, in a Vancouver hybrid setting. 8+ years' experience and Vault expertise are required.

Qualifications

• 8+ years in Platform/Cyber Security or Cloud Infra roles.
• Expert-level Vault Enterprise with ACLs, Auth Methods, Dynamic Secrets.
• Experience developing Vault plugins and scripting via Vault CLI/APIs in Python/Go.
• Proven track record managing global cluster topologies, replication, and upgrades.
• Deep knowledge of modern identity patterns (OIDC, OAuth, IAM, LDAP/AD).
• Solid cryptography and PKI lifecycle understanding.
• Experience with compliance controls and auditing frameworks.

Responsibilities

• Operate and secure enterprise secrets management architectures globally with high availability and DR.
• Design dynamic secrets, lease-based access, and Just-In-Time provisioning workflows.
• Integrate secret injection and rotation into CI/CD pipelines and IaC environments.
• Develop policy-as-code modules and manage ACLs and authentication mappings for compliance.
• Support PAM integrations and automated trust relationships.
• Analyze audit logs and patterns to detect policy breaches and strengthen security posture.
• Create runbooks and self-service automation scripts (Python/Go) and architecture blueprints.

Skills

HashiCorp Vault

Vault Plugins

Python/Go

CI/CD

Zero-Trust

Tools

HashiCorp Vault Enterprise

GitLab CI/CD

Job description

Randstad Canada is seeking a Platform Engineer to design and operate a global, cryptographic secrets infrastructure. You will implement zero-trust access, dynamic secrets, and JIT provisioning across multi-region cloud environments, integrating with GitLab pipelines and IaC tools.

The role emphasizes high availability, compliance, and automation, including plugin development and policy-as-code, in a Vancouver hybrid setting. 8+ years' experience and Vault expertise are required.