Application Security (AppSec) / DevSecOps Engineer

Job Summary

Work Mode

• The position is remote; the job details also specify offshore location.

Employment Details

• Employment type is stated as Contract in the job details.
• The job information section separately lists Job Type as Full time.

Requirements

• Requires 4 to 8 years of core software engineering or cloud DevOps experience and at least 3 dedicated years securing SDLCs and engineering DevSecOps pipelines.
• Requires mastery of automated testing engines such as Snyk, Checkmarx, Veracode, or OWASP ZAP, plus container security and infrastructure-as-code hardening.
• Requires understanding of OWASP Top 10 vulnerabilities, API security, modern secure coding standards, and cryptographic signing protocols.
• One mandatory certification is required: CASE, CDP, CSSLP, or CEH.

Key Responsibilities

• Integrate automated security testing gates into CI/CD pipelines such as GitHub Actions, GitLab CI, and Jenkins.
• Configure application scanning for SAST, DAST, and SCA.
• Triage and remediate software vulnerabilities, dependency risks, and secret exposure with development teams.
• Lead threat modeling assessments, identify attack surfaces, and define secure coding frameworks.
• Manage vulnerability aggregation dashboards and secret vaults, including examples such as DefectDojo, SonarQube, HashiCorp Vault, and AWS Secrets Manager.
• Secure container workloads by auditing Dockerfiles, verifying baseline images, and checking Kubernetes network isolation.
• Investigate application-layer incidents involving malicious requests, API tampering logs, and XSS vectors.

Preferred Qualifications

• Prior software development experience with Java, Python, JavaScript/Node.js, or Go is preferred.
• Experience implementing automated code patching or managing runtime application self-protection layers is preferred.