Senior Ethical Hacker
Stantec
Turn this role into an interview — a resume and cover letter built around what this employer wants.
Benefits offered by this job
Job summary
Stantec is seeking a Senior Ethical Hacker to perform security assessments on web applications and cloud services, emulating real-world attacks per the MITRE ATT&CK framework. You will uncover vulnerabilities, misconfigurations and risks to prevent breaches and strengthen security posture.
Responsibilities include cross-functional collaboration, comprehensive reporting, remediation process design, and presenting results to executives.
Qualifications
- Minimum 5 years of cybersecurity experience with offensive security or red team work.
- Proficient in manual web and cloud penetration testing without automated tools.
- Proven ability to write custom attack tools in Python, PHP, Golang and Bash.
- Experience with Burp Suite Enterprise and building attack automation pipelines.
- Strong reporting skills and comfortable presenting findings to leadership.
Responsibilities
- Collaborate with security, engineering, cloud and network teams.
- Create reports and communicate findings to technical teams and executives.
- Develop processes to help remediation goals and test debriefs with sponsors.
- Conduct penetration tests on cloud systems, apps and APIs.
- Assess configurations, access controls and encryption in cloud environments.
- Engineer Python, Terraform and Ansible extensions for security use cases.
- Lead internal Red/ Purple team engagements and live hacking webinars.
Skills
Education
Tools
Job description
- OffSec Web Expert (OSWE) - Preferred
- OffSec (OSAI) - Preferred
At Stantec, we have some of the world’s leading professionals passionate about enabling our business to be its best. Our business teams include finance, procurement, human resources, information technology, marketing, corporate development, HSSE, real estate, legal, and practice services. We bring diverse backgrounds, skills, and expertise and create a caring culture where everyone can thrive. Through teamwork and collaboration, we’re building a stronger, more resilient Stantec every day.
The Senior Ethical Hacker will conduct security assessments on web applications and cloud services by emulating real-world attacks using the Mitre Attack Framework. Their goal is to identify security weaknesses, help prevent data breaches and enhance the security posture by uncovering vulnerabilities, misconfigurations, and risks proactively before they are discovered by threat actors.
- Collaborate with cross-functional teams (security, engineering, cloud and network operations).
- Create reports and communicate findings to various technical teams, architects and engineers.
- Create and communicate processes that could help engineering teams meet remediation goals.
- Create and verbally present your test findings in debrief meetings with the C-Suite or sponsors.
- Conduct penetration tests on cloud systems, applications and APIs to identify vulnerabilities.
- Assess cloud/application specific configurations, access controls, and encryption mechanisms.
- Validate and exploit security findings within web/thick client apps and cloud environments.
- Validate various app services, databases, Kubernetes, serverless functions, container instances, images and cloud storage blob/buckets for security issues.
- Assist/Create rules of engagement for new pen test projects.
- Architect automated workflows for independent security evaluation and assurance processes
- Establish and enforce security baseline controls through Policy-as-Code implementations
- Engineer custom Python, Terraform, and Ansible extensions to enable specialized security and infrastructure use cases
- Create or populate content in the internal training lab so developers and security champions can stay current in offensive security with practical CTF's when time permits.
- Provide live hacking webinars for teams interested in learning by example.
- Conduct internal Red Team engagements.
- Participate in purple team engagements.
- Minimum 5-7+ years working in some aspect of cybersecurity (Offensive Security, Red Team experience preferred).
- Proficient with manual web/cloud penetration testing without using any tools.
- Proficient writing custom attack tools in Python, PHP, Golang and Bash Scripting.
- Proficient with interception proxies and attacking manually via Burp Suite Enterprise tool.
- Proficient building/maintaining attack automation systems (Commercial or Open-Source).
- Proficient building containers and automation pipelines for attacking purposes.
- Experience combining multiple low/medium findings to weaponize and achieve a higher level.
- Comfortable working exclusively from Windows or Linux command line.
- Comfortable 'living off the land' using VIM/VI/Bash/SH/Perl/VBScript/WMI/PowerShell for post exploitation and lateral movement.
- Comfortable with writing XSS attacks, System/SQL injection payloads or weaponizing binaries.
- Comfortable attacking various popular public cloud services in (Azure/AWS/GCP/Oracle).
- Comfortable presenting audit findings to a small group or C-Suite during debrief meetings.
- Comfortable taking ownership for testing actions and performing blameless post-mortems.
- OffSec Web Expert (OSWE) - Preferred
- OffSec (OSAI) - Preferred
- GIAC Web Application Penetration Tester (GWAPT)
- Burp Suite Certified Practitioner (BSCP)
- Pentester Academy Cloud Security Professional (PACSP)
- AI/LLM Penetration testing experience
- Acknowledged findings in a responsible disclosure or public, private Bug Bounty program.
- Certified Kubernetes Security Specialist (CKS)
- Terraform Associate (003)
- DevSecOps experience
- Minimum 5 years relevant experience.
- Related Degree or Certificate, preferably in areas of Offensive Security, AI Red Teaming or Application
- Security
- Locations Outside of Lower Mainland - BC & Various locations in Ontario-$105,400.00 - $158,100.00 Annually
- Locations in Lower Mainland -- BC, GTA & Ottawa Ontario-$114,600.00 - $164,600.00 Annually
In compliance with pay transparency laws, pay ranges are provided for positions in locations where required. Please note, the final agreed upon compensation is based on individual education, qualifications, experience, and work location. At Stantec certain roles are bonus eligible. Actual compensation for part-time roles will be pro-rated based on the agreed number of working hours per week.
Regular full-time and part-time employees (working at least 20 hours per week) will have access to health, dental, and vision plans, a wellness program, health care spending account, wellness spending account, group registered retirement savings plan, employee stock purchase program, group tax-free savings account, life and accidental death & dismemberment (AD&D) insurance, short-term/long-term disability plans, emergency travel benefits, tuition reimbursement, professional membership fee coverage, and paid time off.
Temporary/casual employees will have access to group registered retirement savings plan, employee stock purchase program, and group tax-free savings account.
The benefits information listed above may not apply to union positions because benefits for such positions are governed by applicable collective bargaining agreements.
Canada | ON | Toronto
Canada | BC | Vancouver
BC-1374 IT Services-CA Corporate
Regular
Replacement
No
Full time
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
