DevSecOps Engineer

We are seeking a skilled DevSecOps Engineer to embed security practices throughout our software development lifecycle, from code commit to production deployment. The ideal candidate will focus primarily on DevSecOps activities including CI/CD pipeline security, cloud and infrastructure protection, as well as managing security monitoring tools. This role also involves overseeing our SIEM system and conducting penetration testing on an as-needed basis to ensure robust security posture.

Key Responsibilities

- Integrate security scanning tools within CI/CD pipelines, including SAST, DAST, software composition analysis (SCA), and secret scanning tools such as GitLeaks and TruffleHog.
- Manage vulnerabilities using a dedicated platform (e.g., DefectDojo), including triaging, tracking, and driving remediation efforts.
- Secure containerized environments (Docker, Kubernetes) and perform Infrastructure-as-Code (IaC) scanning to identify and mitigate risks.
- Harden cloud and server environments by managing secrets securely and enforcing least-privilege access controls.
- Automate patch management, vulnerability tracking, and generate security reports to maintain visibility and compliance.
- Administer and maintain the Wazuh SIEM/XDR platform, including agent deployment, custom rule creation, decoder development, integrations, and tuning for optimal alert accuracy.
- Conduct daily security alert reviews, triage events, investigate high-severity incidents to determine root cause, and escalate confirmed security incidents appropriately.
- Perform authorized penetration testing of web applications and infrastructure, providing clear and actionable reports.

Required Qualifications

- Minimum of one year of experience in DevSecOps, DevOps with a security emphasis, or a closely related field.
- Practical experience with CI/CD tools such as GitLab CI/CD, Jenkins, or GitHub Actions, focusing on pipeline security.
- Hands-on administration of SIEM/XDR platforms, preferably Wazuh, including agent management, rule tuning, and alert triage.
- Proficiency in cloud security across major providers like AWS, Azure, or GCP, along with container security and Linux system administration.
- Familiarity with security scanning tools covering SAST, DAST, SCA, and secret detection, plus experience with vulnerability management platforms.
- Solid understanding of OWASP Top 10 security risks and secure coding principles.
- Scripting skills in Bash, Python, or similar languages to automate security tasks.
- Effective communication skills to collaborate with both technical and non-technical stakeholders.
- Relevant certifications are preferred but not mandatory if strong hands-on expertise is demonstrated. These include:
- DevSecOps certifications such as Certified DevSecOps Professional (CDP) or equivalent.
- Cloud and DevOps certifications like AWS Security Specialty, AWS DevOps Engineer, or Microsoft Azure AZ-400/AZ-500.
- Security foundation certifications such as CompTIA Security+ or CySA+.
- Container and IaC certifications like Certified Kubernetes Administrator (CKA), Certified Kubernetes Security Specialist (CKS), or HashiCorp Terraform Associate are advantageous.

Preferred Qualifications and Benefits

- Experience in detection engineering and writing SIEM rules to enhance threat detection capabilities.
- Knowledge of Web Application Firewalls (WAF), large-scale patch management, and compliance frameworks.
- A demonstrated security portfolio, including contributions to GitHub projects, blogs, CVEs, or security write-ups, is highly desirable.
- Competitive monthly salary range between Rs70,000 and Rs90,000.
- This position requires in-person attendance at the designated work location.

Candidates interested in this opportunity are encouraged to apply with an updated CV and a brief summary highlighting their most relevant DevSecOps project experience.