Senior DevSecOps Engineer

Role summary

Responsibilities

• Build and maintain CI/CD security automation across GitHub, GitLab, Jenkins, or Azure DevOps.
• Integrate SAST, DAST, SCA, and security testing tools including Semgrep, ZAP, Nuclei, and Burp.
• Normalize security findings in SARIF or JSON and route results to DefectDojo and Jira.
• Implement checks for Terraform, CloudFormation, Dockerfiles, container images, and cloud infrastructure.
• Build telemetry ingestion, enrichment, schema mapping, and quality controls for AWS, Azure, Windows, and M365 sources.
• Create reusable security artefacts, rules, templates, and notebooks for red, blue, and purple team activities.
• Create disposable Active Directory, cloud, and containerized labs using Terraform and Ansible.
• Develop automation and self-healing capabilities; establish security metrics, SLIs/SLOs, and build-stage gates.
• Improve manual workflows and partner with engineering and security operations teams on scalable, developer-friendly tools.

Experience and technical requirements

• At least six years of experience.
• Advanced proficiency in Python or Go and strong experience building automation, APIs, and internal tooling.
• Hands-on experience with Jenkins, GitHub Actions, GitLab CI, or Azure DevOps; familiarity with GitOps and modern DevOps practices.
• Practical experience with ZAP, Semgrep, Nuclei, SARIF, JSON, CycloneDX, and SBOMs; understanding of vulnerability management and security testing automation.
• Experience with Docker and Kubernetes; practical experience with AWS and/or Azure.
• Understanding of container image hardening and runtime security controls.
• Experience with log parsing, schema mapping, enrichment, and Kafka, Kinesis, or equivalent streaming technologies.
• Experience with Terraform, CloudFormation, Ansible, or similar technologies.
• Ability to collaborate across software engineering and security operations and translate security requirements into developer-friendly solutions.

Nice to have

• Experience implementing OWASP DSOMM.
• GIAC Cloud Security Automation (GCSA), HashiCorp Certified: Terraform Associate, Certified Kubernetes Administrator (CKA), or DevSecOps/DevOps certifications such as DSOE or CDP.