Description
About the Role
We are looking for a DevSecOps Engineer / Senior DevSecOps Engineer to integrate security into our development and operations lifecycle. This role focuses on securing cloud environments, applications, and CI/CD pipelines through automation and best practices.
In addition to DevSecOps responsibilities, experience in security operations (SOC), threat detection, and incident response will be highly beneficial, as the role collaborates closely with security teams to strengthen overall security posture.
Key Responsibilities:
- Integrate security into CI/CD pipelines (SAST, DAST, SCA, container and IaC scanning).
- Implement and manage security controls across Azure, AWS, and hybrid environments.
- Secure Infrastructure as Code (IaC) using Terraform, ARM, or similar tools.
- Collaborate with DevOps teams to enforce secure coding and deployment practices.
- Implement container and Kubernetes security best practices (RBAC, network policies, image scanning).
- Manage secrets and credentials securely (Azure Key Vault, AWS Secrets Manager).
- Automate security processes and remediation using scripting and pipeline integrations.
- Monitor and improve cloud security posture using tools such as Microsoft Defender, Azure Security Center, or AWS Security Hub.
- Apply IAM, RBAC, and Zero Trust principles across environments.
- Support vulnerability management processes and remediation efforts.
- Contribute to compliance initiatives (SOC2, ISO 27001, CIS benchmarks).
- Work closely with SOC teams to align threat detection and response with DevSecOps practices
Qualifications:
- DevSecOps Engineer: 2–4 years of experience in DevOps, Security, or DevSecOps.
- Senior DevSecOps Engineer: 5+ years of experience with strong hands-on expertise in DevSecOps and cloud security.
- Hands-on experience with CI/CD tools (Azure DevOps, GitHub Actions, Jenkins).
- Strong familiarity with cloud platforms (Azure and/or AWS).
- Proficiency in scripting (PowerShell, Python, Bash) and Infrastructure as Code (Terraform preferred).
- Understanding of application security principles (OWASP Top 10).
- Knowledge of IAM, RBAC, and network security fundamentals.
Nice to Have (Highly Beneficial):
