Senior DevSecOps Engineer

Job Overview

This role demands active involvement in engineering to develop and manage a collaborative automation framework central to security operations and software development life cycles. The position aims to minimize repetitive tasks, automate security processes, and integrate security seamlessly into DevOps workflows using scalable and dependable DevSecOps tools.

Key Responsibilities

• Design, implement, and maintain CI/CD security automation pipelines utilizing platforms like GitHub, GitLab, Jenkins, or Azure DevOps.
• Incorporate security testing tools including SAST, DAST, and SCA methods with technologies such as Semgrep, ZAP, Nuclei, and Burp Suite.
• Normalize and manage processing of security detection outputs in SARIF/JSON format to feed into systems like DefectDojo and Jira for tracking.
• Apply security validation checks for infrastructure as code artifacts including Terraform and CloudFormation scripts, Dockerfiles, container images, and cloud setups.
• Develop mechanisms for ingesting, enriching, and mapping security telemetry from sources like AWS, Azure, Windows, and M365 while ensuring data quality.
• Create and maintain reusable security components, rules, templates, and analytical notebooks supporting various security team operations.
• Establish disposable lab environments simulating Active Directory, cloud, and container systems through Terraform and Ansible tools.
• Automate and integrate self-healing features to augment reliability of security pipelines and throughput of security operations.
• Define security metrics, service level indicators/objectives, and integrate security gates into build phases to enhance visibility for engineering teams.
• Continuously identify inefficiencies in manual tasks to optimize security workflows and improve user experience for security practitioners.
• Collaborate closely with software developers and security operations personnel to translate requirements into scalable, user-friendly tooling solutions.

Candidate Requirements

• Possess at least six years of professional experience in related fields.
• Advanced skills in Python or Go programming languages.
• Significant experience in creating automation solutions, APIs, and various internal development tools.
• Practical knowledge working with CI/CD platforms such as Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
• Understanding of modern DevOps methodologies including GitOps principles.
• Hands-on familiarity with security engineering tools like ZAP, Semgrep, Nuclei, as well as formats including SARIF, JSON, CycloneDX, and Software Bill of Materials (SBOMs).
• Insight into vulnerability management and automation for security testing.
• Experience with containerization technologies including Docker and Kubernetes.
• Proven experience working with cloud services such as AWS and/or Azure platforms.
• Knowledge of container image hardening techniques and runtime security procedures.
• Background in processing logs, schema mapping, data enrichment, and streaming using technologies like Kafka or Kinesis.
• Competency with infrastructure-as-code tools such as Terraform, CloudFormation, and Ansible.
• Demonstrated capacity for effective collaboration across software engineering and security operation teams.
• Ability to transform technical security requirements into accessible and developer-oriented solutions.

Preferred Qualifications

• Hands-on experience deploying OWASP DevSecOps Maturity Model (DSOMM).
• GIAC Cloud Security Automation (GCSA) certification.
• HashiCorp Certified: Terraform Associate credential.
• Certified Kubernetes Administrator (CKA) certification.
• Additional certifications related to DevSecOps or DevOps, such as DSOE or CDP.