Sr. HashiCorp Vault Specialist

{
  "content_hash": "4fbd354c35290407da93d569a06fda2389d02e03811a7e1e866647b380dce599",
  "source_hash": "cee6aeb47b399dac02027f1410032e997b0fcb64a04d7cfb1d9eaa4194334c76",
  "last_changed_at": "2026-06-06T10:25:19.678Z",
  "active_status": "active"
}

{
  "language": "en",
  "location": {
    "raw": "Montreal, Quebec, H2Y 2S8, Canada",
    "city": "Montreal",
    "region": null,
    "country": "Canada",
    "is_remote": true,
    "confidence": 0.95
  },
  "salary_max": null,
  "salary_min": null,
  "inferred_at": "2026-06-06T10:25:19.677Z",
  "launch_scope": {
    "reason": "bamboohr_production_catalog",
    "included": true,
    "location": {
      "raw": "Montreal, Quebec, H2Y 2S8, Canada",
      "city": "Montreal",
      "region": null,
      "country": "Canada",
      "is_remote": true,
      "confidence": 0.95
    },
    "countries": [
      "Canada"
    ]
  },
  "remote_policy": "remote",
  "salary_period": null,
  "workplace_type": "remote",
  "salary_currency": null
}

{}

{
  "list_job": {
    "id": "263",
    "isRemote": null,
    "location": {
      "city": "Montreal",
      "state": "Quebec"
    },
    "atsLocation": {
      "city": null,
      "state": null,
      "country": null,
      "province": null
    },
    "departmentId": "18918",
    "locationType": "2",
    "jobOpeningName": "Sr. HashiCorp Vault Specialist",
    "departmentLabel": "Delivery - Staff Aug",
    "employmentStatusLabel": "Contractor"
  },
  "detail_errors": [],
  "detail_job_opening": {
    "location": {
      "city": "Montreal",
      "state": "Quebec",
      "postalCode": "H2Y 2S8",
      "addressCountry": "Canada"
    },
    "datePosted": "2026-06-05",
    "atsLocation": {
      "city": null,
      "state": null,
      "country": null,
      "countryId": null
    },
    "description": "<p><span style=\"font-family: arial, helvetica, sans-serif\"><span style=\"font-size: 18pt\">About Arctiq:</span><br></span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><br></span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\">Arctiq is a North American professional and managed services firm built around three Centers of Excellence: Enterprise Security, Modern Infrastructure, and Platform Engineering. We help large enterprises modernize how they deliver IT — connecting infrastructure, security, networking, applications, and cloud into a coherent operating model rather than a stack of disconnected tools.</span></p>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\">We are a HashiCorp Hyper-Specialized partner, the highest tier in the HashiCorp Partner Network, and Canada's exclusive HashiCorp Virtual Bench partner, with over half of our delivery consultants holding HashiCorp certifications and a recognized HashiCorp Ambassador and Core Contributor on staff. This role is a staff augmentation engagement: the consultant joins a large regulated Quebec enterprise's internal platform security team, embedded on their Vault product team, while remaining part of Arctiq's HashiCorp practice and bench.</span></p>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><span style=\"font-size: 18pt\">Role Summary:</span><br></span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><br></span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\">The HashiCorp Vault Specialist owns the day-to-day engineering and operation of the client's Vault platform, which delivers machine-identity secrets management to internal consumer teams as a self-service product. Consumers raise a ticket in ServiceNow that triggers a GitHub Actions pipeline. The pipeline runs Terraform that configures Vault itself, including secret engines such as KV v2, dynamic-secret engines, policies, and auth methods, so most of the day-to-day engineering work happens through IaC against Vault rather than clicks in the Vault UI. A central part of the platform's direction is the shift from static, long-lived secrets to dynamic, short-lived credentials issued by Vault on demand. Migrating consumer teams from static to dynamic is not in this role's scope; that work sits with the domain teams themselves. What the Vault team delivers, however, must be ready to support that change in shape and load once those teams adopt the new services. The consultant won't work in ServiceNow much, but needs to understand where the consumer's process starts and how it hands off into the pipeline they own. The role sits on an internal platform security team alongside product and domain architects. The architects architect; the senior is expected to drive goals to completion, align with the architects and the business needs above, and translate that alignment into the work the team actually ships. The team needs someone who can be a solid agile/scrum participant, including documentation, handle incidents already triaged by tier-1 and tier-2, mentor junior engineers who will be shadowing the work so decisions need to be right the first time rather than discovered by trial-and-error, and look ahead to keep the platform stable as consumer teams scale. Scaling is not theoretical: the current setup has already hit roadblocks, and the next iteration needs to absorb more consumer teams without each new onboarding becoming a custom build.</span></p>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"> <span style=\"font-size: 18pt\">What You Will Do:</span><br></span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><br></span></p>\n<ul>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Write and review the Terraform that configures Vault: secret engines (KV v2, dynamic-secret engines), policies, auth methods.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Ship changes through the team's GitHub Actions pipeline; almost never through the Vault UI.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Keep the self-service endpoint healthy as more consumer teams onboard, refactoring so each new team is a configuration change rather than a custom build.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Get ahead of the load and shape changes that come with the shift from static, long-lived secrets to dynamic, short-lived credentials.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Handle Vault incidents after tier-1 and tier-2 triage: root-cause through audit logs, Terraform state, and pipeline runs; ship the fix and the follow-up hardening.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Participate fully in agile/scrum ceremonies and documentation.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Mentor and pair with junior engineers in a way that can be shadowed: explain the reasoning, document the patterns, and make decisions deliberately so the next engineer can replicate the approach instead of guessing.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Drive assigned goals to completion, aligning execution with the product and domain architects above and translating that alignment into the work the team actually ships.</span></li>\n</ul>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"> </span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 18pt\">Qualifications</span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><span style=\"font-size: 18pt\">Required:</span></span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><br></span></p>\n<ul>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Production HashiCorp Vault experience at senior level: hands-on ownership of secret engines, policies, and auth methods on a platform other teams depend on.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Fluent reading Vault audit logs and acting on them.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Strong Terraform practitioner, configuring Vault and adjacent platforms through IaC; reviewing other engineers' Terraform with an eye for safety and drift.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">CI/CD-driven workflow experience (GitHub Actions, GitLab CI, or equivalent); can debug a pipeline failure end-to-end.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Direct experience with the static-to-dynamic secrets shift: dynamic-secret engines (databases, cloud IAM, PKI, or similar) in production, not just in a lab.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Incident handling on a critical platform after tier-1 and tier-2 triage, with the judgment to decide what gets fixed now, what gets hardened later, and what gets documented for the next responder.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Mentoring junior engineers in a way that can be shadowed: explaining reasoning, documenting patterns, and making deliberate decisions others can replicate.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Drives assigned goals to completion in agile/scrum and aligns execution with product and domain architects, without needing strategy set at the task level.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Language profile matching the header: primary working language in Quebec French, International French, or English; complementary English at C1 (French-primary) or native/C1+ (English-primary).</span></li>\n</ul>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><span style=\"font-size: 18pt\">Preferred:</span><br></span></p>\n<p><br></p>\n<ul>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">HashiCorp Vault Associate or Operations Professional certification, or equivalent demonstrable depth (talks, contributions, internal write-ups).</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Adjacent HashiCorp tools, in particular Boundary (access) and Consul (service identity).</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Regulated-sector experience (financial services, healthcare, government, critical infrastructure) where security controls, audit, and change management are non-classic in shape.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Cloud IAM and secret-management at one or more major clouds (AWS, Azure, GCP).</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Prior consulting or staff-augmentation experience: joining an existing team, learning its conventions quickly, adding value without imposing.</span><br></li>\n</ul>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><span style=\"font-size: 18pt\">Engagement Details:</span><br></span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><br></span></p>\n<ul>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Contract holder: Arctiq. The consultant is on Arctiq paper, billed to the end client.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Hours / commitment: Full-time, approximately 40 hours per week, Eastern Time business hours.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Time-zone overlap: Eastern Time required for daily standup and incident response.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">On-site cadence: Occasional, near Montréal or Québec City. Hybrid or remote within Canada otherwise.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Path to permanent: Contract-first through end of 2026, renewable up to end of 2028, with possible conversion to permanent by Arctiq or the client.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Rate range: [to confirm with the client / internal]</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Security clearance or background check: [to confirm: regulated-sector clients sometimes require one]</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Equipment: Client-issued laptop, VPN, and MFA are the likely model. On the Arctiq side, web-based access may be sufficient for a staff-aug engagement; an Arctiq-issued laptop is not assumed.</span></li>\n</ul>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"> </span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 18pt\">Tech Stack &amp; Tools:</span></p>\n<p><br></p>\n<ul>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Working environment: French-speaking, with English as a second language for most colleagues. French preferred, English required.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Secrets platform: HashiCorp Vault Enterprise. Vault Dedicated (HashiCorp's SaaS) is very likely not the deployment, but candidates should be ready to discuss either, since Vault Dedicated requires an AWS or Azure private link that the Vault team would deploy, configure, and maintain.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">IaC: Terraform, configuring Vault and adjacent platforms.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">CI/CD: GitHub Actions, running Terraform against Vault as the team's primary deployment path. The current pipeline shape works but is in scope for refactoring as the platform scales: the consultant will be expected to look at maintainability (reusable workflows, modular Terraform, predictable change-management) rather than only adding features on top of what exists.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Consumer-side intake: ServiceNow ticket triggers the GitHub Actions pipeline. The Vault team won't work in ServiceNow much but needs to understand the handoff.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Observability: Vault audit logs are the primary signal for incident response. Where they get shipped downstream is not part of the assumptions here.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Cloud: Primarily Azure and AWS, with very little GCP. The screen should test general cloud-infrastructure depth (IAM, core services, architecture, cloud-native concepts) rather than fluency in any one provider. The exception is Vault deployment methods: candidates need to understand how Vault is deployed on AWS and Azure, especially the private-link work that any Dedicated-style deployment requires, since the Vault product team would own that foundation as well as the Vault platform itself.</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Version control &amp; code review: [to confirm: GitHub Enterprise assumed given GitHub Actions]</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Other HashiCorp tools in scope or adjacent: [to confirm: Boundary, Consul, Terraform Cloud or Enterprise]</span></li>\n</ul>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif; font-size: 18pt; font-weight: bold\">Other Details:</span></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"> </span></p>\n<ul>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">4 openings</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Contract</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Duration: Through end of 2026, renewable up to end of 2028, with possible conversion to permanent</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Hybrid or remote within Canada, near Montreal or Quebec, occasional onsite</span></li>\n<li><span style=\"font-family: arial, helvetica, sans-serif\">Immediate Start</span></li>\n</ul>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\"><span style=\"font-weight: bold\">Language requirements:</span> Quebec French, International French, or English as primary working language. If French is primary, English at CEFR C1 (advanced) is required. If English is primary, native-level or C1+ English is required.</span></p>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\">Must be able to read dense HashiCorp Vault, Terraform, CI/CD pipeline, and cloud-provider documentation; parse a Vault audit log or Terraform error and immediately know what's wrong; and follow GitHub issues, RFCs, and vendor blog posts written in informal, abbreviated English. </span></p>\n<p><br></p>\n<p><span style=\"font-family: arial, helvetica, sans-serif\">Must synthesize across multiple sources to infer the right answer when no single page gives it, a senior-level skill independent of language. Both are required.</span></p>",
    "compensation": null,
    "departmentId": "18918",
    "locationType": "2",
    "seekPromoted": false,
    "jobCategoryId": null,
    "jobOpeningName": "Sr. HashiCorp Vault Specialist",
    "departmentLabel": "Delivery - Staff Aug",
    "jobOpeningStatus": "Open",
    "minimumExperience": "Experienced",
    "jobOpeningShareUrl": "https://arctiq.bamboohr.com/careers/263",
    "employmentStatusLabel": "Contractor"
  }
}