Senior Offensive Security Engineer – Web & Cloud

Stantec; Vancouver; On-site; CAD 105,000 - 165,000; Full time

Job summary

Stantec is seeking an Senior Ethical Hacker to perform security assessments on web apps and cloud services, emulating real-world attacks using the Mitre Attack Framework. The role aims to uncover vulnerabilities, misconfigurations and risks before threat actors exploit them.

You will collaborate with security, engineering and cloud teams, create remediation reports, and present findings to executives. Strong TS/CI/CD security expertise and hands-on tooling are essential.

Qualifications

• Minimum 5-7+ years in cybersecurity (Offensive Security, Red Team preferred).
• Proficient with manual web/cloud penetration testing without tools.
• Proficient writing custom attack tools in Python, PHP, Golang and Bash scripting.
• Proficient with interception proxies and Burp Suite Enterprise.
• Proficient building/maintaining attack automation systems.
• Comfortable with Windows or Linux command line and security tooling.

Responsibilities

• Collaborate with cross-functional teams (security, engineering, cloud, network ops).
• Create reports and communicate findings to technical teams and executives.
• Conduct penetration tests on cloud systems, apps and APIs to identify vulnerabilities.
• Validate and exploit findings in web apps and cloud environments.
• Develop automation and policy-as-code for security controls and testing workflows.
• Deliver live hacking webinars and participate in Red/ Purple team engagements.

Skills

Offensive Security

Red Team

Manual penetration testing

Python scripting

Golang

Bash scripting

Burp Suite

Cloud security

Education

Related Degree or Certificate in Offensive Security/AI Red Teaming or App Security

Tools

Burp Suite

Python

Golang

Terraform

Ansible

Kubernetes

Job description

Stantec is seeking an Senior Ethical Hacker to perform security assessments on web apps and cloud services, emulating real-world attacks using the Mitre Attack Framework. The role aims to uncover vulnerabilities, misconfigurations and risks before threat actors exploit them.

You will collaborate with security, engineering and cloud teams, create remediation reports, and present findings to executives. Strong TS/CI/CD security expertise and hands-on tooling are essential.