IT - DevSecOps Specialist

DevSecOps Specialist is responsible for integrating security practices into the Software Development Life Cycle (SDLC), CI/CD pipelines, cloud infrastructure, and operational processes. This role ensures that security is embedded throughout the development lifecycle while enabling agile delivery and maintaining compliance with organizational and regulatory requirements.

The position collaborates closely with Development, Infrastructure, Cloud Engineering, Quality Assurance, Architecture, and Information Security teams to build secure, scalable, and resilient systems.

Responsibilities

DevSecOps Integration

• Design and implement DevSecOps practices across application development and infrastructure deployment processes.
• Embed security controls throughout the SDLC.
• Automate security testing and validation within CI/CD pipelines.
• Establish secure coding, security-by-design, and shift-left security practices.

CI/CD Security

• Build and maintain secure CI/CD pipelines using:

  • Jenkins
  • GitLab CI/CD
  • GitHub Actions
  • Azure DevOps

• Integrate security scanning tools including:

  • SAST (Static Application Security Testing)
  • DAST (Dynamic Application Security Testing)
  • SCA (Software Composition Analysis)
  • IaC Security Scanning

Cloud & Infrastructure Security

• Implement and maintain security controls across cloud platforms:

  • AWS
  • Microsoft Azure
  • Google Cloud Platform (GCP)

• Secure containerized environments:

  • Docker
  • Kubernetes
  • OpenShift

• Enforce infrastructure security through Infrastructure as Code (IaC):

  • Terraform
  • CloudFormation
  • Ansible

Security Automation

• Automate vulnerability assessment and remediation processes.

• Develop scripts and automation solutions using:

  • Python
  • Bash
  • PowerShell

• Implement policy-as-code and compliance-as-code frameworks.

Vulnerability Management

• Conduct security assessments and vulnerability reviews.

• Analyze findings from:

  • Checkmarx
  • Veracode
  • SonarQube
  • Snyk
  • Fortify
  • Prisma Cloud
  • Aqua Security

• Coordinate remediation activities with engineering teams.

Monitoring & Incident Response

• Support security monitoring and logging initiatives.
• Integrate security alerts into operational workflows.
• Participate in security incident investigations and post-incident reviews.
• Improve detection and response capabilities.

Compliance & Governance

• Support compliance initiatives related to:

  • ISO 27001
  • PCI DSS
  • NIST Cybersecurity Framework
  • CIS Benchmarks
  • OWASP Top 10
  • SOC 2

• Ensure systems comply with organizational security policies and regulatory requirements.

Security Awareness

• Promote secure development practices among engineering teams.
• Conduct threat modeling and secure code review workshops.
• Provide technical guidance on security best practices.

Qualifications

Education

• Bachelor‘s degree in:
  • Information Technology
  • Computer Science
  • Cybersecurity
  • Software Engineering
  • Related disciplines

• At least 5+ years of experience in DevSecOps, Cloud Security, or Security Engineering.

Technical Skills

DevOps Tools

• Git
• GitHub
• GitLab
• Bitbucket
• Jenkins
• Azure DevOps

Cloud Platforms

• AWS
• Azure
• GCP

Container & Orchestration

• Docker
• Kubernetes
• OpenShift

Security Tools

• SonarQube
• Checkmarx
• Veracode
• Snyk
• Fortify
• Prisma Cloud
• Aqua Security
• Qualys
• Nessus

Infrastructure as Code

• Terraform
• CloudFormation
• Ansible

Programming/Scripting

• Python
• Bash
• PowerShell
• YAML

Security Knowledge

• Secure SDLC
• Threat Modeling
• Secure Coding Practices
• Zero Trust Architecture
• Identity and Access Management (IAM)
• Secrets Management
• Vulnerability Management

Preferred Certifications

Security Certifications

• CISSP
• CISM
• CEH
• CompTIA Security+

Cloud Security Certifications

• AWS Certified Security Specialty
• Microsoft Azure Security Engineer Associate (AZ-500)
• Google Professional Cloud Security Engineer

DevSecOps Certifications

• Practical DevSecOps Professional (PDSP)
• Certified DevSecOps Professional (CDP)

Kubernetes Certifications

• Certified Kubernetes Security Specialist (CKS)
• Certified Kubernetes Administrator (CKA)