DevSecOps Lead

Position Overview

As the DevSecOps Lead specializing in Product Security & Compliance at FutureCraft, you will be responsible for ensuring that every product we develop is inherently secure and compliant from inception. Your role involves integrating security practices into our development lifecycle and continuous integration/continuous deployment (CI/CD) pipelines, safeguarding our applications, APIs, smart contracts, and cloud infrastructure. Additionally, you will translate compliance standards such as SOC 2, ISO 27001, PCI-DSS, GDPR, and the DPDP Act into automated security controls.

You will collaborate closely with Engineering, Product Management, and the Cloud & IT Infrastructure teams, while also establishing and expanding a dedicated security engineering function as the company grows. This position is pivotal in building trust with our enterprise and BFSI clients.

Core Responsibilities

• Secure SDLC & CI/CD:
  • Integrate security checks into all pipelines, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), secrets scanning, container security, and Infrastructure as Code (IaC) scanning.
  • Establish security gates and quality thresholds that prevent risky releases without hindering delivery timelines.
  • Secure the software supply chain through dependency management, image signing, Software Bill of Materials (SBOMs), and artifact provenance verification.
• Product & Application Security:
  • Conduct threat modeling and security design reviews for new features, services, and APIs.
  • Develop and enforce secure coding standards, authentication and authorization patterns, and encryption best practices for product teams.
  • Coordinate penetration testing, smart contract audits, and bug bounty programs; oversee remediation efforts until closure.
• Cloud Workload Security:
  • Secure Kubernetes, container, and serverless workloads across AWS, Azure, and Google Cloud platforms.
  • Manage secrets and cryptographic keys using Vault, KMS, and Key Vault; enforce principle of least privilege in IAM configurations.
  • Implement cloud security posture management and policy-as-code guardrails in collaboration with the Cloud & IT Infrastructure team.
• Compliance Automation:
  • Translate standards such as SOC 2, ISO 27001, PCI-DSS, GDPR, and the DPDP Act into technical controls applicable to our products.
  • Automate evidence collection and continuous compliance monitoring to support external audits.
  • Maintain data classification, logging, retention policies, and privacy controls within our applications.
• Vulnerability Management & Incident Response:
  • Lead vulnerability triage and ensure timely fixes across codebases, dependencies, containers, and cloud workloads.
  • Implement security logging, SIEM alerts, and lead investigations of product security incidents.
• Enablement & Leadership:
  • Provide training to developers on secure coding practices and foster security champions within product teams.
  • Respond to client security questionnaires and support enterprise security assessments.
  • Recruit, mentor, and develop security engineers as the security function expands.

Required Skill Set

• Proficiency with DevSecOps tooling: SonarQube, Snyk, Checkmarx, OWASP ZAP/Burp Suite, Trivy, Checkov, Gitleaks
• Experience with CI/CD platforms: GitHub Actions, GitLab CI, Jenkins, or Azure DevOps
• Deep understanding of Application Security principles: OWASP Top 10, API security (Top 10), OAuth2/OIDC, JWT, encryption, threat modeling (STRIDE)
• Knowledge of Cloud & Container Security: AWS, Azure, GCP security services, Kubernetes security, Wiz/Prisma Cloud, OPA/Kyverno
• Experience managing secrets and keys: HashiCorp Vault, AWS KMS/Secrets Manager, Azure Key Vault
• Strong understanding of compliance standards: SOC 2, ISO 27001, PCI-DSS, GDPR, DPDP Act, and automation tools like Vanta or Drata
• Monitoring & SIEM expertise: Splunk, Microsoft Sentinel, ELK Stack, AWS Security Hub
• Programming and scripting skills: Python, Bash; ability to interpret Go, Java, JavaScript/TypeScript, or Solidity code

Qualifications & Experience

• Experience:
  • 6–10 years in DevSecOps, application security, or security engineering roles
  • Proven experience designing and implementing secure CI/CD pipelines with integrated security testing
  • Hands-on expertise in securing cloud-native applications, including containers, microservices, and APIs
  • Experience in implementing controls for SOC 2, ISO 27001, or PCI-DSS audits
  • Proven ability to collaborate with developers to identify and remediate vulnerabilities at the source
• Education:
  • Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field
• Certifications (Preferred):
  • AWS Certified Security – Specialty or equivalent Azure/GCP security certification
  • CKS (Certified Kubernetes Security Specialist)
  • OSCP, GWAPT, or CSSLP
  • CISSP or CCSP
  • ISO 27001 Lead Implementer

Additional Qualifications (Preferred)

• Experience in blockchain, cryptocurrency, or digital asset security, including smart contract security
• Background in fintech or BFSI sectors with regulatory exposure to RBI or SEBI
• Experience securing AI and ML systems and data pipelines
• Experience managing bug bounty or responsible disclosure programs
• Contributions to security communities, open-source security tools, or published research in the security domain

What We Offer

• A strategic role in shaping the security architecture of FutureCraft’s innovative blockchain-AI platform from the ground up.
• Competitive salary packages, performance-based bonuses, and equity options.
• Access to advanced hardware resources such as NVIDIA H200 clusters and generous cloud credits.
• Opportunities for professional growth through certifications, training, and conference sponsorships.
• A collaborative and innovative work environment at our Pune headquarters dedicated to cutting-edge technology development.