Senior DevSecOps Engineer

We have an opportunity for a Senior DevSecOps Engineer role to join our Engineering Team. In this role, you will ensure the security and compliance of our software applications and infrastructure. Your main tasks will include implementing security checks in CI/CD pipelines, conducting security assessments and vulnerability scans, monitoring system logs for security incidents, and promoting a culture of security awareness among the development teams. You will collaborate with various teams to ensure secure software delivery and improve efficiency through automation.

Key Responsibilities

• Implement security checks in CI/CD pipelines
• Design, implement, and maintain a vulnerability management platform
• Conduct regular security assessments, vulnerability scans, and penetration tests to identify and mitigate security weaknesses in applications, infrastructure, and code
• Monitor and analyze system logs, security events, and alerts to promptly identify and respond to security incidents
• Ensure software applications adhere to industry regulations, standards, and security policies
• Implement and maintain security controls and procedures to meet compliance requirements
• Assess and prioritize potential security threats and vulnerabilities, and identify appropriate countermeasures and mitigation strategies
• Implement and maintain dependency management processes and tools
• Harden Kubernetes clusters, on-prem and cloud infrastructure for enhanced security
• Implement security tools within Kubernetes clusters
• Enforce custom policies on Kubernetes objects using OPA (Open Policy Agent)
• Design and implement a secure development strategy
• Build secure base images for development teams
• Automate security-related tasks and processes, such as vulnerability scanning, code analysis, and compliance checks to improve efficiency and accuracy
• Participate in infrastructure architecture and services development as a security expert
• Educate development teams on secure coding practices, security risks, and emerging threats, promoting a culture of security awareness and responsibility
• Work closely with development, operations, and security teams to foster collaboration, share knowledge, and align objectives to ensure secure software delivery

You Are a Great Fit If You Have

• A least 6 to 8 years of experience in development
• Strong communication and collaboration skills to work effectively across teams.
• Excellent problem-solving abilities and the capacity to provide innovative and effective security solutions.
• Extensive experience in DevSecOps methodologies, with a proven track record in implementing security practices within complex software environments.
• Deep understanding of security principles, secure coding practices, and secure SDLC.
• Strong proficiency in CI/CD, IaC, and automated testing, with expertise in tools like Gitlab CI, Git, Docker, Terraform and Kubernetes.
• Expertise in conducting advanced security assessments, vulnerability scanning, penetration testing, and code reviews.
• Extensive experience with security automation using languages like Go, Python and Bash.
• Strong knowledge of security assessment and testing tools like Burp Suite, Nuclei, or OWASP ZAP.
• In-depth understanding of cloud security principles and experience working with major cloud service providers (e.g., AWS, Azure, GCP) to architect secure cloud infrastructure.
• Extensive experience with security monitoring tools, SIEM, IDS, log analysis, and incident response processes.
• Familiarity with compliance frameworks and standards relevant to the organization's industry and ability to ensure compliance across systems and applications.
• Proven track record of successfully implementing security controls and hardening measures for infrastructure components, including network devices, servers, and databases.

Bonus Points If You

• Knowledge of devops process for Salesforce systems like SFSC, SFCC, SFMC, SFDC
• Have a Bachelor's degree in Computer Science or related field
• Have experience achieving SOC2 HIPAA, ISO 27001 Compliance levels
• Experience with security at the network, transport, and application layers (DNS-SEC, OWASP, HTTP, TLS, etc.)