Sr. Vault Specialist

Company Overview:

Arctiq is a global, intelligence-driven technology services company delivering professional and managed services across Hybrid Cloud Infrastructure, Networking & Connected Experiences, Cybersecurity, Data & AI, Autonomous Operations & Intelligence, and Enterprise Service Management. We help organizations operate, secure, and modernize complex environments by unifying infrastructure, networking, data, security, automation, and observability under a single, integrated operating model. Our work focuses on helping customers reduce operational friction, improve resilience, and make better, faster decisions as their environments evolve. Arctiq builds on decades of industry expertise and a customer-centric ethos to deliver exceptional value to clients across diverse industries.

We are a HashiCorp Hyper-Specialized partner, the highest tier in the HashiCorp Partner Network, and Canada's exclusive HashiCorp Virtual Bench partner, with over half of our delivery consultants holding HashiCorp certifications and a recognized HashiCorp Ambassador and Core Contributor on staff. This role is a staff augmentation engagement: the consultant joins a large regulated Quebec enterprise's internal platform security team, embedded on their Vault product team, while remaining part of Arctiq's HashiCorp practice and bench.

Position Overview:

The HashiCorp Vault Specialist owns the day-to-day engineering and operation of the client's Vault platform, which delivers machine-identity secrets management to internal consumer teams as a self-service product. Consumers raise a ticket in ServiceNow that triggers a GitHub Actions pipeline. The pipeline runs Terraform that configures Vault itself, including secret engines such as KV v2, dynamic-secret engines, policies, and auth methods, so most of the day-to-day engineering work happens through IaC against Vault rather than clicks in the Vault UI. A central part of the platform's direction is the shift from static, long-lived secrets to dynamic, short-lived credentials issued by Vault on demand. Migrating consumer teams from static to dynamic is not in this role's scope; that work sits with the domain teams themselves. What the Vault team delivers, however, must be ready to support that change in shape and load once those teams adopt the new services. The consultant won't work in ServiceNow much, but needs to understand where the consumer's process starts and how it hands off into the pipeline they own. The role sits on an internal platform security team alongside product and domain architects. The architects architect; the senior is expected to drive goals to completion, align with the architects and the business needs above, and translate that alignment into the work the team actually ships. The team needs someone who can be a solid agile/scrum participant, including documentation, handle incidents already triaged by tier-1 and tier-2, mentor junior engineers who will be shadowing the work so decisions need to be right the first time rather than discovered by trial-and-error, and look ahead to keep the platform stable as consumer teams scale. Scaling is not theoretical: the current setup has already hit roadblocks, and the next iteration needs to absorb more consumer teams without each new onboarding becoming a custom build.

Responsibilities:

• Write and review the Terraform that configures Vault: secret engines (KV v2, dynamic-secret engines), policies, auth methods.
• Ship changes through the team's GitHub Actions pipeline; almost never through the Vault UI.
• Keep the self-service endpoint healthy as more consumer teams onboard, refactoring so each new team is a configuration change rather than a custom build.
• Get ahead of the load and shape changes that come with the shift from static, long-lived secrets to dynamic, short-lived credentials.
• Handle Vault incidents after tier-1 and tier-2 triage: root-cause through audit logs, Terraform state, and pipeline runs; ship the fix and the follow-up hardening.
• Participate fully in agile/scrum ceremonies and documentation.
• Mentor and pair with junior engineers in a way that can be shadowed: explain the reasoning, document the patterns, and make decisions deliberately so the next engineer can replicate the approach instead of guessing.
• Drive assigned goals to completion, aligning execution with the product and domain architects above and translating that alignment into the work the team actually ships.

Qualifications:

• Production HashiCorp Vault experience at senior level: hands-on ownership of secret engines, policies, and auth methods on a platform other teams depend on.
• Fluent reading Vault audit logs and acting on them.
• Strong Terraform practitioner, configuring Vault and adjacent platforms through IaC; reviewing other engineers' Terraform with an eye for safety a