Senior DevSecOps Engineer

# DLTJP00060696 – Senior DevSecOps Engineer

**Team:** Platform / Release Engineering

**Position:** 1

**Experience:** 8+ Years

**Budget:** ₹16 LPA – ₹22 LPA

**Role Level:** Senior / Staff DevSecOps Engineer

## About the Role

We're looking for a Senior/Staff DevSecOps Engineer to own the release engineering and security-in-the-pipeline story end to end. You'll design systems that enable engineers to deploy to production with one click, roll changes out progressively using blue/green and canary strategies, and automatically roll them back when issues arise, while integrating security controls throughout the pipeline.

This is a builder's role. You will automate operational and manual work, decentralize security into the delivery workflow, and deliver the same platform reliably across multiple client environments. You'll partner with product, engineering, and security teams working in Kanban/sprint cadences to make releases reliable and predictable.

## Key Responsibilities

### 1. Release Engineering & Progressive Delivery

- Design and operate single-click deployment pipelines for fast, safe, and reliable production releases.

- Implement and optimize progressive rollout strategies, including blue/green, canary, rolling, and feature-flag-gated releases.

- Configure automated health checks, metric-based promotion, and automatic rollback on regression.

- Own end-to-end release cycle planning, including cut plans, release calendars, freeze/branching strategies, change-safety reviews, go/no-go criteria, and post-release validation.

- Coordinate product releases across multiple clients and tenants, managing environment-specific configurations, staggered rollouts, and version skew.

- Plan and execute platform version upgrades covering runtimes, dependencies, base images, and clusters, with zero- or minimal-downtime migration paths and rollback plans.

- Reduce release toil by automating manual deployment steps.

### 2. Security – Shift-Left / DevSecOps

- Integrate security into CI/CD through automated gates for SAST, DAST, and software composition analysis (SCA), including dependency and license risk.

- Scan Infrastructure-as-Code (Terraform, Helm, and Kubernetes manifests) for misconfigurations before production deployment.

- Manage secrets using Vault, cloud KMS, or sealed secrets, ensuring no plaintext credentials are stored in code, images, or pipelines.

- Secure the software supply chain by generating and tracking SBOMs, signing artifacts and container images using Sigstore/cosign, and enforcing provenance through SLSA-style attestations.

- Triage and prioritize vulnerabilities using CWE/OWASP taxonomies, drive remediation SLAs, and reduce mean time to remediate.

- Implement policy-as-code using OPA/Gatekeeper or Kyverno and compliance-as-code to automate audit evidence generation.

### 3. Kubernetes & Platform

- Build, operate, and extend Kubernetes workloads.

- Author and run Operators, including custom controllers and CRDs, to automate stateful and platform lifecycle tasks.

- Implement GitOps delivery using Argo CD or Flux.

- Package applications using Helm/Kustomize and manage traffic through service meshes such as Istio or Linkerd for canary and blue/green routing.

- Manage cluster upgrades, node lifecycle, and platform hardening across environments.

### 4. Reliability

- Define and maintain SLOs and error budgets to balance release velocity and stability.

- Integrate observability through metrics, logs, traces, dashboards, and actionable alerts into deployments.

- Participate in on-call rotations, incident response, and blameless postmortems.

- Convert incident findings into playbooks and automation to prevent recurrence.

### 5. Ways of Working

- Work in Kanban/sprint-based release teams, planning, estimating, and unblocking release work alongside product and engineering teams.

- Provide client-facing release support and communicate change windows, rollout status, and remediation to internal and external stakeholders.

- Maintain runbooks, release documentation, and self-service guides.

## Required Skills & Experience

- 8+ years of experience in DevOps, DevSecOps, Platform Engineering, or SRE roles, with clear ownership of production release pipelines.

- Hands-on experience implementing blue/green and canary deployments and single-click/automated release workflows using GitHub Actions, GitLab CI, Jenkins, Argo, Spinnaker, or similar tools.

- Strong production experience with Kubernetes and Docker/OCI containers, including exposure to the Operator pattern (CRDs and controllers).

- Proficiency in Infrastructure-as-Code tools such as Terraform and Helm, and experience with at least one cloud platform: AWS, GCP, or Azure.

- Demonstrated security-in-the-pipeline experience involving SAST/DAST/SCA, IaC scanning, secrets management, or vulnerability remediation.

- Scripting and automation experience in at least one language: Go, Python, or Bash. Go is a plus for Operators.

- Experience owning end-to-end release cycles and deploying across multiple clients/environments.

- Strong focus on automation and making risky changes safe.

## Nice-to-Have Skills

- Building Operators using Operator SDK, Kubebuilder, or controller-runtime.

- Multi-tenant SaaS release experience and staged, per-client rollout strategies.

- Familiarity with compliance frameworks such as SOC 2, ISO 27001, FedRAMP, and PCI-DSS, preferably implemented as code.

- Supply-chain security experience with SLSA, Sigstore/cosign, in-toto, and SBOM tools such as Syft/Grype.

- Certifications such as CKA, CKAD, CKS, or equivalent cloud/security certifications.

- Experience with service meshes, feature-flag platforms such as LaunchDarkly/Flagsmith, and progressive-delivery tools such as Argo Rollouts or Flagger.

Pay: Up to ₹2,200,000.00 per year

Work Location: Hybrid remote in Hyderabad, Telangana