DevSecOps Engineer

About the role

We are looking for a DevSecOps Engineer to embed security throughout our software delivery pipelines and cloud infrastructure. The role will partner with development and operations teams to automate security controls, remediate vulnerabilities, and support compliance initiatives.

Key responsibilities

• Integrate automated security testing (SAST, DAST, SCA, secrets scanning, container security scanning) into CI/CD pipelines and enforce policy‑as‑code gates.
• Design, build, and maintain secure infrastructure as code (Terraform, CloudFormation or similar) following least‑privilege and defense‑in‑depth principles.
• Harden containerized and serverless workloads (Docker, Kubernetes) and implement runtime security monitoring.
• Manage secrets, keys, and certificates using HashiCorp Vault, AWS Secrets Manager or comparable solutions.
• Triage, prioritize, and remediate vulnerabilities with development teams, tracking findings to closure and reducing mean‑time‑to‑remediate.
• Build security automation and self‑service tooling to reduce manual toil for engineers.
• Monitor cloud environments for misconfigurations and threats using CSPM/CNAPP tools and centralized logging (SIEM).
• Contribute to incident response activities, including detection, investigation, containment, and post‑incident reviews.
• Support compliance and audit efforts (SOC 2, ISO 27001, PCI‑DSS, HIPAA) by codifying and evidencing controls.

Required profile

• 4+ years of experience in DevSecOps, SRE, security engineering or a related field with demonstrable security responsibilities.
• Hands‑on experience with at least one major cloud provider (AWS, Azure, or GCP) and its native security services.
• Proficiency with CI/CD platforms such as GitHub Actions, GitLab CI, or Jenkins.
• Strong scripting/automation skills in Python, Bash, Go or comparable languages.
• Working knowledge of infrastructure‑as‑code and configuration management.
• Familiarity with container orchestration (Kubernetes) and container security practices.
• Solid understanding of common vulnerability classes (e.g., OWASP Top 10) and secure software development practices.

Required skills

• Terraform
• CloudFormation
• Docker
• Kubernetes
• HashiCorp Vault
• AWS Secrets Manager
• Python
• Bash
• Go
• GitHub Actions
• GitLab CI
• Jenkins
• OPA/Rego
• Sentinel
• SonarQube
• Twistlock
• AWS, Azure, GCP
• SAST
• DAST
• SCA
• CSPM
• CNAPP
• SIEM