Senior Web Security Hacker (OSWE-Preferred)

Stantec; Quebec; On-site; CAD 105,000 - 165,000; Full time

Benefits offered by this job

Health coverage

Dental & vision

Wellness program

RRSP / pension plan

Employee stock purchase program

Tuition reimbursement

Job summary

Stantec is seeking a Senior Ethical Hacker to conduct security assessments on web applications and cloud services using the Mitre ATT&CK framework. You will identify vulnerabilities, misconfigurations and risks, and help improve our security posture before threats materialize.

The role involves cross-functional collaboration, debriefing findings with executives, and building automation tools in Python, Terraform and Ansible. Toronto or Québec locations are possible with on-site work expectations.

Qualifications

• Minimum 5-7+ years in cybersecurity, Offensive Security or Red Team preferred.
• Proficient with manual web/cloud penetration testing without tools.
• Able to write custom attack tools in Python, PHP, Golang and Bash.
• Experience with interception proxies and Burp Suite Enterprise.
• Experience building attack automation systems and containers.

Responsibilities

• Collaborate with security, engineering, cloud and network ops teams.
• Create and present test findings to executives and sponsors.
• Pen test cloud systems, apps and APIs; assess configurations and access controls.
• Architect automated workflows and policy-as-code for security baselines.
• Develop content for internal training and live hacking webinars.

Skills

Web application pentesting

Cloud pentesting

Python scripting

Burp Suite

Kubernetes

Terraform

Ansible

Windows/Linux CLI

Red Team / blue team thinking

Education

Related Degree or Certificate

Tools

Burp Suite Enterprise

Terraform

Ansible

Kubernetes

Python

Job description

Stantec is seeking a Senior Ethical Hacker to conduct security assessments on web applications and cloud services using the Mitre ATT&CK framework. You will identify vulnerabilities, misconfigurations and risks, and help improve our security posture before threats materialize.

The role involves cross-functional collaboration, debriefing findings with executives, and building automation tools in Python, Terraform and Ansible. Toronto or Québec locations are possible with on-site work expectations.