DevSecOps Engineer

About the Role We are looking for a skilled DevSecOps Engineer to integrate security throughout the software development and deployment lifecycle. The successful candidate will work closely with Development, DevOps, Infrastructure, and Security teams to build secure, automated, scalable, and reliable delivery pipelines.

The role will focus on CI/CD security, cloud security, infrastructure security, vulnerability management, container security, security automation, and compliance.

Key Responsibilities

• Design and implement secure CI/CD pipelines with security controls integrated throughout the SDLC.
• Implement DevSecOps practices across development, testing, deployment, and production environments.
• Integrate SAST, DAST, SCA, secret scanning, container scanning, and IaC security tools into CI/CD pipelines.
• Identify, assess, prioritize, and remediate security vulnerabilities.
• Secure cloud environments across platforms such as AWS, Azure, or GCP.
• Implement and maintain secure Docker and Kubernetes environments.
• Apply infrastructure-as-code security practices using tools such as Terraform, Ansible, or CloudFormation.
• Implement security controls for source-code repositories, branching strategies, pull requests, and developer workflows.
• Manage secrets, credentials, certificates, keys, and privileged access securely.
• Establish security monitoring, logging, alerting, and incident-response capabilities.
• Collaborate with developers to remediate application and infrastructure security issues.
• Automate security testing and compliance checks wherever possible.
• Support vulnerability management, penetration testing, and security assessments.
• Develop and maintain security policies, standards, procedures, and technical documentation.
• Support compliance requirements such as ISO 27001, SOC 2, PCI DSS, GDPR, or applicable regulatory frameworks.
• Continuously evaluate emerging DevSecOps tools, technologies, and security practices.

Required Skills &

Experience

• 3–6 years of experience in DevOps, Cloud Security, Application Security, or DevSecOps.
• Strong understanding of CI/CD pipelines and software development lifecycle.
• Hands-on experience with Git, GitHub/GitLab/Bitbucket, Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
• Experience with security testing tools such as:
• SAST
• DAST
• SCA
• Secret scanning
• Container security
• IaC security
• Strong Linux and scripting skills using Bash, Python, or PowerShell.
• Experience with Docker and preferably Kubernetes.
• Practical knowledge of AWS, Azure, or GCP security.
• Knowledge of IAM, RBAC, network security, encryption, TLS, secrets management, and zero-trust principles.
• Experience with Infrastructure as Code, preferably Terraform.
• Understanding of common application security risks, including OWASP Top 10.
• Experience with vulnerability management and security remediation.
• Strong understanding of networking concepts including TCP/IP, DNS, HTTP/HTTPS, firewalls, VPNs, and load balancers.

Preferred Qualifications

• Experience with SIEM, SOAR, EDR, CSPM, CNAPP, or cloud-native security platforms.
• Experience securing Kubernetes and cloud-native workloads.
• Knowledge of software supply-chain security and SBOM.
• Familiarity with security frameworks such as NIST, CIS, ISO 27001, and OWASP.
• Experience implementing security gates and automated policy enforcement in CI/CD.
• Knowledge of threat modeling and secure architecture.
• Experience with security incident response.

Certifications Any of the following are a plus:

• CKS – Certified Kubernetes Security Specialist
• CKA – Certified Kubernetes Administrator
• AWS Security Specialty
• Azure Security Engineer Associate
• GCP Professional Cloud Security Engineer
• Security
• CISSP
• OSCP
• GIAC certifications

Key Performance Indicators

• Reduction in critical and high-severity vulnerabilities.
• Security coverage across CI/CD pipelines.
• Reduction in security-related deployment risks.
• Vulnerability remediation within defined SLAs.
• Improved cloud and infrastructure security posture.
• Automation of security controls and testing.
• Successful compliance and security assessments.

Education Bachelor’s degree in Computer Science, Information Security, Software Engineering, IT, or a related field is preferred. Equivalent practical experience may be considered.