Job Summary:
We are looking for a candidate to lead end-to-end vulnerability management initiatives, implementing DevSecOps practices, and securing cloud-native applications. The role involves proactive engagement with clients and internal teams to strengthen security posture across applications, infrastructure, and CI/CD pipelines, ensuring alignment with organizational security policies and compliance standards.
Key Responsibilities:
- Lead vulnerability scanning, analysis, prioritization, and remediation efforts across diverse environments.
- Maintain oversight of the end-to-end vulnerability management process, ensuring timely resolution and continuous improvement.
- Monitor vulnerabilities (including analysis of CERT advisories) and propose effective remediation plans, considering business impact and technical exposure.
- Evaluate and secure client software development practices by integrating security controls into the SDLC and CI/CD pipelines (shift-left approach).
- Determine the real impact of vulnerabilities and ensure risk-based prioritization.
- Implement, enhance, and maintain DevSecOps practices across development and operations teams.
- Integrate, configure, and manage secure public cloud services (AWS, Azure, or GCP).
- Collaborate with the Cloud SecOps team to strengthen cloud-native application security.
- Create and maintain accurate project and technical documentation.
- Liaise with clients, stakeholders, and internal teams to align security strategies with business objectives.
Skills & Qualifications:
- Minimum 4 years of professional experience in cybersecurity, vulnerability management, or DevSecOps.
- Strong understanding of CVE analysis and ability to communicate vulnerabilities to both technical and non-technical audiences.
- Proficiency in Python and Shell scripting (experience in additional languages is a plus).
- Hands-on experience with Docker and Kubernetes.
- Practical experience with at least one major cloud platform (AWS, Azure, or GCP).
- Familiarity with vulnerability scanning tools such as Qualys, Prisma Cloud, or equivalent.
- Working knowledge of DevSecOps tools such as SAST, SCA, Snyk, or Checkmarx.
- Experience in implementing secure SDLC and build processes.
