DevSecOps Engineer

We are seeking a skilled DevSecOps Engineer to join our team. In this role. The ideal candidate has a solid background in DevOps, cloud platforms, CI/CD pipelines and tools and security integration.

Role Description:

In this role the following responsibilities will be expected from you:

• Perform TARA analysis on a cloud system by analyzing architecture diagrams, identifying important data and components, list components that need protection and apply STRIDE or attack trees to find analyze and evaluate threats.
• Identify how cloud features will be used to protect the system and build cybersecurity concepts, cybersecurity plan, and risk reports.
• Derive cybersecurity goals and requirements
• Identify cloud misconfiguration and analyze their impact on system vulnerability.
• Test access rules and perform IAM privilege escalation tests and trust abuse.
• Ensure API protection and login security.
• Perform container/runtime scanning by running vulnerability scans and using CVE scanners to scan Docker images and base OS.
• Ensure runtime security by performing DAST, SAST and SCA.
• Perform secure code review to detect insecure code patterns and run language specific scans and secure code review automation.
• Build vulnerability reports with problems and suggested solutions.
• Build security policies by developing REST API security rules and well architected frameworks.
• Perform policy testing by enforcing guardrails (SCPs and RCPs)
• Enforce CI/CD hardening using IaC or other methods.
• Implement GitOps-based deployment and security workflows using tools like ArgoCD or Flux.
• Enforce continuous monitoring by using CNAPP for auditing.
• Develop and maintain incident response playbooks and support root cause analysis post-incident
• Automate security workflows and remediation steps using scripting (Python, Bash) or tools like AWS Lambda, Cloud Functions.
• Enforce cybersecurity processes such as vulnerability management and defining how to handle findings and patching.
• Support audits and create documentation for compliance (SOC 2, GDPR, HIPPA, etc.)
• Share knowledge and lead teams of developers and testers.
• Serve as a bridge between DevOps and InfoSec to align goals and priorities.

Qualifications and Education Requirements:

• Bachelor’s or master’s degree in computer science, Information Security, Software Engineering, or related field.
• +3 years of relevant experience.
• Strong experience with CI/CD pipelines and tools (e.g., Jenkins, GitLab CI, GitHub Actions, Azure DevOps).
• Deep knowledge of security integration in DevOps workflows (SAST, DAST, IAST).
• Proficiency with containerization and orchestration (Docker, Kubernetes, Helm).
• Familiarity with infrastructure-as-code (IaC) tools (Terraform, Ansible, Pulumi).
• Experience with cloud platforms (AWS, Azure, GCP) including IAM, key management, security groups, and VPCs.
• Knowledge of code scanning, dependency scanning, and secrets management tools (e.g., SonarQube, Checkmarx, Snyk, HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault).
• Experience integrating logging and monitoring tools with SIEM systems (Splunk, ELK, etc.) to detect anomalies and security threats.
• Understanding of security standards and frameworks (OWASP, NIST, ISO 27001, CIS Benchmarks).
• Strong collaboration and communication skills across DevOps, security, and development teams.
• Analytical mindset with the ability to respond to vulnerabilities or incidents effectively.
• Self-driven and proactive in improving security posture through automation.

What makes us special:

• International team, with a collegial working atmosphere and motivating team spirit.
• Lived culture of innovation and Regular employee events.
• Continuous internal trainings and external trainings.
• Outstanding benefits, health insurance, multiple optional allowances, and pension plans.
• Flexible working hours, work from home option to ensure Work-life balance.
• An environment where you can develop and grow your skills, capabilities, and future.

Data privacy:

All the information shared in this document are only intended to the recipient. Any attempt to copy or re-use the document in part or whole will be considered a violation to the data privacy and will put the person under the law responsibility.