Responsibilities

DevSecOps Integration

• Design and implement DevSecOps practices across application development and infrastructure deployment processes.
• Embed security controls throughout the SDLC.
• Automate security testing and validation within CI/CD pipelines.
• Establish secure coding, security-by-design, and shift-left security practices.

CI/CD Security

• Build and maintain secure CI/CD pipelines using:

  • Jenkins
  • GitLab CI/CD
  • GitHub Actions
  • Azure DevOps

• Integrate security scanning tools including:

  • SAST (Static Application Security Testing)
  • DAST (Dynamic Application Security Testing)
  • SCA (Software Composition Analysis)
  • IaC Security Scanning

Cloud & Infrastructure Security

• Implement and maintain security controls across cloud platforms:

  • AWS
  • Microsoft Azure
  • Google Cloud Platform (GCP)

• Secure containerized environments:

  • Docker
  • Kubernetes
  • OpenShift

• Enforce infrastructure security through Infrastructure as Code (IaC):

  • Terraform
  • CloudFormation
  • Ansible

Security Automation

• Automate vulnerability assessment and remediation processes.

• Develop scripts and automation solutions using:

  • Python
  • Bash
  • PowerShell

• Implement policy-as-code and compliance-as-code frameworks.

Vulnerability Management

• Conduct security assessments and vulnerability reviews.

• Analyze findings from:

  • Checkmarx
  • Veracode
  • SonarQube
  • Snyk
  • Fortify
  • Prisma Cloud
  • Aqua Security

• Coordinate remediation activities with engineering teams.

Monitoring & Incident Response

• Support security monitoring and logging initiatives.
• Integrate security alerts into operational workflows.
• Participate in security incident investigations and post-incident reviews.
• Improve detection and response capabilities.

Compliance & Governance

• Support compliance initiatives related to:

  • ISO 27001
  • PCI DSS
  • NIST Cybersecurity Framework
  • CIS Benchmarks
  • OWASP Top 10
  • SOC 2

• Ensure systems comply with organizational security policies and regulatory requirements.

Security Awareness

• Promote secure development practices among engineering teams.
• Conduct threat modeling and secure code review workshops.
• Provide technical guidance on security best practices.

Qualifications

Education

• Bachelor‘s degree in:
  • Information Technology
  • Computer Science
  • Cybersecurity
  • Software Engineering
  • Related disciplines

• At least 5+ years of experience in DevSecOps, Cloud Security, or Security Engineering.

Technical Skills

DevOps Tools

• Git
• GitHub
• GitLab
• Bitbucket
• Jenkins
• Azure DevOps

Cloud Platforms

• AWS
• Azure
• GCP

Container & Orchestration

• Docker
• Kubernetes
• OpenShift

Security Tools

• SonarQube
• Checkmarx
• Veracode
• Snyk
• Fortify
• Prisma Cloud
• Aqua Security
• Qualys
• Nessus

Infrastructure as Code

• Terraform
• CloudFormation
• Ansible

Programming/Scripting

• Python
• Bash
• PowerShell
• YAML

Security Knowledge

• Secure SDLC
• Threat Modeling
• Secure Coding Practices
• Zero Trust Architecture
• Identity and Access Management (IAM)
• Secrets Management
• Vulnerability Management

Preferred Certifications

Security Certifications

• CISSP
• CISM
• CEH
• CompTIA Security+

Cloud Security Certifications

• AWS Certified Security Specialty
• Microsoft Azure Security Engineer Associate (AZ-500)
• Google Professional Cloud Security Engineer

DevSecOps Certifications

• Practical DevSecOps Professional (PDSP)
• Certified DevSecOps Professional (CDP)

Kubernetes Certifications

• Certified Kubernetes Security Specialist (CKS)
• Certified Kubernetes Administrator (CKA)