DevSecOps & Cloud Security Consultant

Position: DevSecOps & Cloud Security Consultant

5–7 years’ experience

Full-time onsite

Initial 1 year

Location: Muscat

1. Job description (JD)

The DevSecOps & Cloud Security Consultant will perform security assessments of DevSecOps pipelines, cloud infrastructure, Kubernetes environments and application delivery processes. The consultant will review CI/CD security, Infrastructure as Code (IaC), Helm charts, source code, cloud configurations and security policies; identify vulnerabilities and misconfigurations; automate security controls; and support security tool evaluation and implementation.

Key responsibilities

• Assess and strengthen security across CI/CD pipelines and DevSecOps workflows.
• Review Infrastructure as Code (IaC) templates for insecure configurations, excessive permissions, hardcoded credentials and exposed secrets.
• Conduct manual and automated security reviews of Kubernetes Helm charts.
• Perform source code security reviews using Static Application Security Testing (SAST).
• Assess cloud security configurations, identity and access management (IAM), network controls, encryption and logging.
• Review Kubernetes security controls and container deployment configurations.
• Implement or validate security automation and policy enforcement using OPA/Gatekeeper.
• Support vulnerability management, risk assessment, remediation tracking and revalidation.
• Evaluate security tools and conduct POCs across cloud, application, container, API and DevSecOps security.
• Prepare assessment findings, risk ratings, remediation recommendations and technical reports.
• Coordinate with development, infrastructure, cloud and Information Security teams.

2. Mandatory technical skills The following skills are explicitly identified in the RFP's Resource 2 profile.

Skill area

Required expertise

DevSecOps security

Security integration throughout software development and deployment workflows

CI/CD security

Pipeline security reviews, automated testing integration and secure delivery processes

Infrastructure as Code (IaC)

Reviewing infrastructure templates for security risks and misconfigurations

Helm chart security

Reviewing deployment charts, Kubernetes security settings and secure deployment practices

Source code review (SAST)

Static analysis and identification of insecure coding practices and vulnerabilities

Cloud security

Cloud configuration reviews, IAM controls, network security, encryption and logging

Kubernetes security

Kubernetes environments, access controls, workloads, configurations and security baselines

Vulnerability management

Vulnerability identification, validation, prioritisation, remediation tracking and retesting

Security automation

Automating security checks and integrating security controls into delivery workflows

Policy enforcement

OPA/Gatekeeper policy validation, compliance enforcement and deployment controls

Security tool evaluation

Assessing security tools, conducting POCs and documenting findings and recommendations

3. Experience requirements

• Overall experience: 5–7 years in DevSecOps and cloud security.
• Hands-on experience securing CI/CD pipelines and software delivery workflows.
• Experience reviewing IaC templates, Helm charts and source code.
• Experience with cloud security configurations and Kubernetes environments.
• Practical knowledge of vulnerability management and security automation.
• Experience implementing or validating policy enforcement using OPA/Gatekeeper.
• Experience evaluating security tools and supporting POC activities.

4. Qualifications and certifications

Graduate with below certifications will be preferred.

• CEH — Certified Ethical Hacker
• CISSP — Certified Information Systems Security Professional
• OSCP — Offensive Security Certified Professional
• CISA — Certified Information Systems Auditor
• CISM — Certified Information Security Manager