Hiring for DevSecOps Lead Position

Key Responsibilities

• Secure SDLC & CI/CD

o Embed security checks into every pipeline: SAST, DAST, SCA, secrets scanning, container and IaC scanning.

o Define security gates and quality thresholds that block risky releases without slowing delivery.

o Secure the software supply chain: dependency management, image signing, SBOMs and artifact provenance.

• Product & Application Security

o Run threat modelling and security design reviews for new features, services and APIs.

o Define secure coding standards, authentication/authorization patterns and encryption practices for product teams.

o Coordinate penetration tests, smart-contract audits and bug bounty findings; track remediation to closure.

• Cloud Workload Security

o Secure Kubernetes, container and serverless workloads across AWS, Azure and GCP.

o Manage secrets and keys (Vault, KMS, Key Vault) and enforce least-privilege IAM for applications.

o Run cloud security posture management and policy-as-code guardrails with the Cloud & IT Infrastructure team.

• Compliance Automation

o Translate SOC 2, ISO 27001, PCI-DSS, GDPR and DPDP Act requirements into technical controls for our products.

o Automate evidence collection and continuous compliance monitoring; support external audits.

o Maintain data classification, logging, retention and privacy controls in our applications.

• Vulnerability Management & Incident Response

o Own vulnerability triage and fix SLAs across code, dependencies, containers and cloud workloads.

o Set up security logging and SIEM alerts for products; lead investigation of product security incidents.

• Enablement & Leadership

o Train developers on secure coding and run security champions across product teams.

o Answer client security questionnaires and support enterprise security reviews.

o Hire and mentor security engineers as the function grows.

3. Skill Set Required

• DevSecOps Tooling: SonarQube, Snyk, Checkmarx, OWASP ZAP/Burp Suite, Trivy, Checkov, Gitleaks

• CI/CD: GitHub Actions, GitLab CI, Jenkins or Azure DevOps

• Application Security: OWASP Top 10 and API Top 10, OAuth2/OIDC, JWT, encryption, threat modeling (STRIDE)

• Cloud & Container Security: AWS/Azure/GCP security services, Kubernetes security, Wiz/Prisma Cloud, OPA/Kyverno

• Secrets & Keys: HashiCorp Vault, AWS KMS/Secrets Manager, Azure Key Vault

• Compliance: SOC 2, ISO 27001, PCI-DSS, GDPR, DPDP Act; compliance automation (Vanta/Drata or similar)

• Monitoring & SIEM: Splunk, Microsoft Sentinel, ELK, AWS Security Hub

• Coding & Scripting: Python, Bash and ability to read Go, Java, JavaScript/TypeScript or Solidity code