Hiring for DevSecOps Lead Position
Job Description
Key Responsibilities
• Secure SDLC & CI/CD
o Embed security checks into every pipeline: SAST, DAST, SCA, secrets scanning, container and IaC scanning.
o Define security gates and quality thresholds that block risky releases without slowing delivery.
o Secure the software supply chain: dependency management, image signing, SBOMs and artifact provenance.
• Product & Application Security
o Run threat modelling and security design reviews for new features, services and APIs.
o Define secure coding standards, authentication/authorization patterns and encryption practices for product teams.
o Coordinate penetration tests, smart-contract audits and bug bounty findings; track remediation to closure.
• Cloud Workload Security
o Secure Kubernetes, container and serverless workloads across AWS, Azure and GCP.
o Manage secrets and keys (Vault, KMS, Key Vault) and enforce least-privilege IAM for applications.
o Run cloud security posture management and policy-as-code guardrails with the Cloud & IT Infrastructure team.
• Compliance Automation
o Translate SOC 2, ISO 27001, PCI-DSS, GDPR and DPDP Act requirements into technical controls for our products.
o Automate evidence collection and continuous compliance monitoring; support external audits.
o Maintain data classification, logging, retention and privacy controls in our applications.
• Vulnerability Management & Incident Response
o Own vulnerability triage and fix SLAs across code, dependencies, containers and cloud workloads.
o Set up security logging and SIEM alerts for products; lead investigation of product security incidents.
• Enablement & Leadership
o Train developers on secure coding and run security champions across product teams.
o Answer client security questionnaires and support enterprise security reviews.
o Hire and mentor security engineers as the function grows.
3. Skill Set Required
• DevSecOps Tooling: SonarQube, Snyk, Checkmarx, OWASP ZAP/Burp Suite, Trivy, Checkov, Gitleaks
• CI/CD: GitHub Actions, GitLab CI, Jenkins or Azure DevOps
• Application Security: OWASP Top 10 and API Top 10, OAuth2/OIDC, JWT, encryption, threat modeling (STRIDE)
• Cloud & Container Security: AWS/Azure/GCP security services, Kubernetes security, Wiz/Prisma Cloud, OPA/Kyverno
• Secrets & Keys: HashiCorp Vault, AWS KMS/Secrets Manager, Azure Key Vault
• Compliance: SOC 2, ISO 27001, PCI-DSS, GDPR, DPDP Act; compliance automation (Vanta/Drata or similar)
• Monitoring & SIEM: Splunk, Microsoft Sentinel, ELK, AWS Security Hub
• Coding & Scripting: Python, Bash and ability to read Go, Java, JavaScript/TypeScript or Solidity code
Sponsored