Role Overview: As a DevSecOps Engineer, your primary responsibility is to combine DevOps and security to create a robust, automated, and secure development pipeline. You will manage and automate CI/CD pipelines, infrastructure provisioning, and cloud environments, while implementing security controls, vulnerability management, and compliance practices at every step. Youll be the go-to person for ensuring that our products and infrastructure are not only efficient and scalable but also secure by design. This is a hands-on role, where you will take full ownership of both the DevOps and security functions in the team. As a key member of our team, you will ensure that security is not an afterthought but an integral part of every step of the development and deployment lifecycle. Key Responsibilities: -Design, document, implement and monitor enterprise-grade secure fault-tolerant infrastructure -Will operate as a technical expert on DevOps infrastructure projects pertaining to Containerization, systems management, design and architecture. Perform performance analysis and optimization, monitoring and problem resolution, upgrade planning and execution, and process creation and documentation. -Integrate newly developed and existing applications into private, public and hybrid cloud environments -CI/CD Pipeline Management: Build, maintain, and optimize CI/CD pipelines for continuous integration and deployment. Embed security at every stage of the pipeline by integrating automated security tests, static and dynamic code analysis, and vulnerability scanning. -Infrastructure Automation: Automate the provisioning and configuration of infrastructure using Infrastructure as Code (IaC) tools like Terraform, CloudFormation, and Ansible, ensuring that security is baked into every environment from the start. -Cloud Infrastructure Management: Manage cloud environments (AWS) by applying security best practices, implementing controls for Identity and Access Management (IAM), network security, and ensuring secure, scalable infrastructure. -Security Automation: Integrate security tools and practices into DevOps workflows, automating vulnerability assessments, container security checks, and IaC security scanning to ensure that security risks are addressed early in the development process. -Container Security: Ensure the security of containerized applications, managing Docker environments. This includes securing container images, applying best practices for container runtime security, and ensuring the integrity of containerized deployments. -Vulnerability Management: Proactively scan and address security vulnerabilities across applications, cloud environments, and infrastructure using tools like SonarQube, and work to remediate issues quickly. -Incident Response & Monitoring: Implement monitoring and logging to detect potential security incidents, leveraging tools like Splunk, CloudWatch, etc. Lead incident response efforts, conducting investigations, and ensuring quick mitigation of security breaches. -Security Integration: Ensure security is integrated into the entire DevOps lifecyclefrom secure coding practices to automated testing and deployment. Work closely with developers and testers to instill security in every phase of product development. -Compliance: Maintain compliance with industry standards (GDPR, SOC 2, ISO 27001) by ensuring that appropriate security measures are implemented in infrastructure, code, and cloud environments. -Continuous Improvement: Stay updated with the latest DevOps and security tools, trends, and vulnerabilities. Continuously improve the security processes and systems, ensuring they scale as the company grows. Required Skills & Qualifications: Experience: 4-5 years of hands-on experience in a DevOps role with security integration (DevSecOps). This includes experience with both DevOps tools and security practices. Cloud Security & Infrastructure: Strong experience with cloud platforms (AWS) and securing cloud infrastructure. Hands-on experience with cloud-native security tools CI/CD & Automation: Expertise in setting up and maintaining CI/CD pipelines (e.g., Jenkins, GitLab CI etc), and integrating automated security checks such as static/dynamic analysis and vulnerability scanning. Security Best Practices: Strong understanding of security practices, including OWASP principles, secure coding, vulnerability management, and implementing security controls in cloud and infrastructure environments. Container Security: Experience with building and securing Docker environments, including container image scanning, container runtime security, and securing orchestration platforms. Infrastructure as Code (IaC): Proficient in IaC tools like Terraform, CloudFormation, or Ansible, ensuring security is embedded at the infrastructure provisioning stage. Scripting & Programming: Proficient in scripting languages such as Python, Bash, or Go to automate security tasks, integrate security tools, and manage cloud infrastructure. Vulnerability Management: Hands-on experience with vulnerability scanning tools like Snyk, Aqua Security, SonarQube, and addressing issues in both the infrastructure and application layers. Monitoring & Incident Response: Experience with security monitoring and logging tools (Splunk, CloudWatch, Datadog, etc.), as well as leading incident response efforts to mitigate security risks. Certifications: Security certifications are a plus, but practical experience and hands-on skills are paramount.
