Senior Cloud & Web Security Penetration Expert

Stantec; Dartmouth; On-site; CAD 105,000 - 165,000; Full time

Benefits offered by this job

Health insurance

Tuition reimbursement

Stock purchase program

Job summary

Stantec is seeking a Senior Ethical Hacker to perform security assessments on web applications and cloud services, emulating real-world attacks within the Mitre ATT&CK framework. The role aims to uncover vulnerabilities, misconfigurations and risks to strengthen overall security posture across hybrid environments.

Responsibilities include conducting cloud and web pentests, crafting remediation reports, and sharing knowledge via live sessions and internal training with security champions.

Qualifications

• Minimum 5-7+ years in cybersecurity, Offensive Security or Red Team experience preferred.
• Proficient with manual web/cloud penetration testing without using any tools.
• Proficient writing attack tools in Python, PHP, Golang and Bash Scripting.
• Proficient with interception proxies and Burp Suite Enterprise tool.
• Proficient building automation pipelines and attack tools using Terraform/Ansible/Kubernetes.

Responsibilities

• Collaborate with cross-functional teams to communicate findings and remediation plans.
• Penetration tests on cloud systems, apps and APIs to identify vulnerabilities.
• Architect automated workflows for independent security evaluation and assurance processes.
• Engineer custom extensions in Python, Terraform, and Ansible for security use cases.
• Present audit findings to stakeholders including C-Suite during debriefs.

Skills

Manual pentesting

Python scripting

Burp Suite usage

Windows/Linux CLI

Cloud security

Threat modeling

Red Team experience

Education

Offensive Security related degree

Tools

Burp Suite

Terraform

Ansible

Kubernetes

Golang

Job description

Stantec is seeking a Senior Ethical Hacker to perform security assessments on web applications and cloud services, emulating real-world attacks within the Mitre ATT&CK framework. The role aims to uncover vulnerabilities, misconfigurations and risks to strengthen overall security posture across hybrid environments.

Responsibilities include conducting cloud and web pentests, crafting remediation reports, and sharing knowledge via live sessions and internal training with security champions.