DevSecOps Engineer

Contour Software, a subsidiary of Constellation Software Inc., has rapidly expanded from a small team to over 2,000 employees across three cities within 14 years. As part of a global software leader with a presence in over 100 countries, Contour offers a dynamic environment for professionals to build long-term careers. The company supports a broad portfolio of enterprise solutions across more than 100 industry domains. Contour operates as a full-service global center, serving divisions worldwide from its offices in Karachi, Lahore, and Islamabad.

Constellation Payment Processing is a modern Payment Facilitator (PayFac) focused on enabling SaaS businesses to grow through embedded payments. Backed by Constellation Software Inc., one of the world’s largest software companies, the team is building a cloud-native PayFac platform on AWS using microservices in TypeScript/JavaScript, Java, Ruby, and ReactJS. The Security Engineer will co-own the DevSecOps program, driving continuous security and compliance automation, penetration testing, and remediation efforts. This role ensures that security and compliance are integral product features, especially for ISV vendors integrating payments via APIs, SDKs, and webhooks. The engineer will design secure integration patterns, harden multi-tenant isolation boundaries, lead supply-chain security, and maintain continuous PCI DSS 4.0 compliance evidence. Additionally, the role involves collaborating with partner security teams, managing incident response, and pioneering AI-assisted security automation to improve detection, triage, and remediation.

Key Responsibilities
- Own security automation by designing and managing CI/CD security toolchains including SAST, SCA, DAST, container/IaC scanning, secrets detection, and SBOM generation. Integrate these tools into GitHub Actions pipelines with automated ticketing and tuning for noise reduction.
- Embed security in the SDLC by creating secure coding standards, conducting threat modeling (STRIDE/PASTA), producing data flow diagrams, and leading a security champions program within engineering squads.
- Harden platform and cloud security on AWS/EKS, including workload admission controls, image signing, runtime protection, IAM least-privilege, key management, network segmentation, and centralized logging. Validate service-to-service authentication and manage security certificates across the stack.
- Automate compliance for PCI DSS 4.0 and other standards by mapping controls, generating audit-ready artifacts, and partnering with compliance teams on policies and vendor assessments.
- Coordinate and scope penetration testing, contribute to incident response playbooks and drills, and participate actively in incident management.
- Research, evaluate, and implement AI/ML security tools for code review assistance, anomaly detection, and auto-remediation while ensuring safe use and governance.
- Define and track KPIs such as MTTR reduction, false-positive rate improvements, auto-triage coverage, AI-generated remediation PRs, and time-to-evidence for compliance audits.

Required Qualifications
- 8–10 years of experience in application/cloud security or DevSecOps, preferably in fintech or payments environments.
- Hands-on experience managing DevSecOps programs with tools like Veracode.
- Proficiency in Terraform for AWS infrastructure and strong CI/CD automation skills (GitHub Actions preferred) using Python, TypeScript, or Bash.
- Solid understanding of AWS security services (IAM, KMS, CloudTrail, GuardDuty, Security Hub, VPC, WAF/Shield) and Kubernetes/EKS hardening.
- Familiarity with microservices architecture, event-driven systems, Domain-Driven Design (DDD), and ability to read TypeScript, Java, Ruby, and ReactJS code.
- Working knowledge of PCI DSS 4.0 control objectives, SOC 2, and ISO 27001 concepts.
- Excellent communication skills with both technical and non-technical stakeholders and a strong bias towards automation and simplification.

Preferred Qualifications and Benefits
- Experience in payments domain technologies such as EMV/3DS, PAN vaulting, network tokenization, P2PE, and chargeback processes is a plus.
- Competitive salary with comprehensive medical coverage for employees and dependents, provident fund, performance bonuses, home internet subsidy, conveyance allowance, and profit-sharing for tenured employees.
- Additional benefits include life insurance, child care facilities, company-provided meals, professional development budget, recreational areas, on-shore training opportunities, friendly work environment, and leave encashment.

Contour is committed to fostering a diverse and inclusive workplace that respects the dignity of every individual. The company actively encourages applications from qualified individuals with special needs and provides reasonable accommodations throughout the recruitment process.