DevSecOps Engineer

DevSecOps Engineer

Domain: Cloud Security, DevOps, Application Security (AppSec)

Position Overview

The DevSecOps Engineer is tasked with incorporating security methodologies into the Software Development Life Cycle (SDLC) and Continuous Integration/Continuous Deployment (CI/CD) pipelines. This mid-level position emphasizes automating security measures, managing vulnerabilities, fortifying cloud infrastructures, and safeguarding application security while maintaining rapid development cycles.

Key Responsibilities

• CI/CD Security Automation: Integrate automated security testing tools into CI/CD workflows (SAST, DAST, SCA, and secret scanning).
• Cloud & Infrastructure Security: Strengthen cloud environments (AWS/Azure/GCP) and evaluate Infrastructure as Code (IaC) scripts (Terraform/CloudFormation) to ensure compliance and identify misconfigurations.
• Vulnerability Management: Review scan results, prioritize vulnerabilities, and collaborate with software developers to address security concerns.
• Container Security: Protect containerized applications and orchestrators (Docker, Kubernetes) through image scanning and the enforcement of runtime policies.
• Compliance & Policy Enforcement: Ensure that deployments conform to security benchmarks (e.g., OWASP Top 10, CIS Benchmarks, NIST).

Requirements

• Experience: Background in DevOps, Application Security, or Systems Engineering with an emphasis on DevSecOps methodologies.
• Pipeline Tools: Familiarity with CI/CD platforms (GitLab CI, GitHub Actions, Jenkins, or Azure DevOps).
• Security Tooling: Proficient in security tools such as SonarQube, Snyk, Checkmarx, OWASP ZAP, Trivy, or Aqua Security.
• Scripting/Coding: Strong scripting capabilities in Python, Bash, or Go for creating automation wrappers.
• Cloud Platforms: Practical experience with cloud security frameworks (AWS, Azure, or GCP).

Top 3 Most Important Skills

1. CI/CD Security Integration & Security Testing: Proven experience in implementing automated security scanning tools—SAST (e.g., SonarQube, Checkmarx), DAST, and SCA (e.g., Snyk, Dependency-Check)—within pipelines (Jenkins, GitLab CI, GitHub Actions).
2. Cloud Security & Infrastructure as Code (IaC): Comprehensive knowledge of securing cloud environments (AWS, Azure, or GCP) and inspecting IaC configurations (Terraform, CloudFormation) for security vulnerabilities using tools like Checkov or Trivy.
3. Container & Kubernetes Security: Proficient in securing containerization (Docker), conducting image scans, ensuring container registry security, and enforcing Kubernetes RBAC/policies (e.g., Aqua Security, Sysdig, Trivy).

Interested candidates are encouraged to provide the following information:

Candidate Name (as per Passport)

Current Location

Total Experience

Relevant Experience

Current Company

Notice Period

Current Salary

Expected Salary

Reason for Change

Important Note:

Please submit your resume in Word format to [HIDDEN TEXT]

If this position does not align with your expertise, feel free to refer friends who might be interested.

For a confidential discussion, interested professionals can contact me at +65 68177759.

Best Regards,

Arti C