Platform and Security Operations Engineer (DevSecOps)

ABOUT FIRST CRYPTO EXCHANGE
First Crypto is a VARA-licensed OTC broker-dealer in Dubai serving individual and institutional clients. We are building our own platform for digital assets and fiat payments, including an OTC desk, web client, and mobile app.
FCE is committed to building a trusted, well-governed exchange, combining robust market infrastructure with strong financial controls, regulatory compliance, and operational transparency.

JOB OVERVIEW
We are looking for a Platform & Security Operations Engineer (DevSecOps) to own and develop our production infrastructure, cloud-native platform, and security operations.
The key objective of this role is to ensure the reliability, scalability, and security of FCE's production environment while strengthening infrastructure automation, security monitoring, incident response, and compliance readiness.
You will work closely with the CTO and a small, experienced engineering team, taking ownership of critical infrastructure and security initiatives in a regulated digital asset environment where reliability and security are essential.

KEY RESPONSIBILITIES
Own and maintain production infrastructure and Kubernetes clusters, ensuring reliability, availability, scalability, and security.
Develop and maintain infrastructure as code using Terraform and Terragrunt, covering networking, data infrastructure, and identity management.
Build, maintain, and improve GitOps workflows and infrastructure delivery processes.
Design and implement security monitoring, including alerts, detection rules, and tuning to reduce false positives.
Develop incident response runbooks and establish on-call procedures.
Respond to production and security incidents, investigate root causes, coordinate remediation, and conduct postmortems.
Improve CI/CD pipelines and strengthen software supply chain security.
Implement security scanning for dependencies and container images, as well as artifact signing and verification.
Establish and maintain infrastructure standards, technical documentation, operational procedures, and security guidelines.
Prepare technical evidence and documentation to support external audits and demonstrate the effectiveness of infrastructure and security controls.
Continuously improve platform security, operational resilience, and incident detection and response capabilities.
Leverage AI-assisted development tools where appropriate, critically reviewing generated code and configurations before deployment.

QUALIFICATIONS & SKILLS
Strong hands-on production experience with Kubernetes, including cluster upgrades, workload identity, network policies, autoscaling, and incident investigation.
Practical experience with Terraform and Terragrunt for infrastructure provisioning and management.
Experience with Atlantis or similar tools for managing and reviewing infrastructure changes.
Hands-on experience implementing GitOps workflows using Flux, Argo CD, or equivalent tools.
Deep knowledge of AWS, including VPC, multi-AZ architecture, KMS, OIDC federation, and DNS.
Practical experience with security monitoring and detection engineering, including alerting, detection rule development, and false-positive reduction.
Experience designing and maintaining secure CI/CD pipelines and implementing software supply chain security controls.
Experience with dependency and container image scanning, artifact signing, and verification.
Experience supporting external security and compliance audits, such as ISO 27001, SOC 2, PCI DSS, HIPAA, or equivalent frameworks.
Proven experience operating production systems where failures or security breaches can result in significant financial losses or regulatory consequences.
Experience developing incident response procedures, conducting root-cause analysis, and documenting postmortems.
Experience using AI-assisted development tools and the ability to critically evaluate AI-generated code and configurations.
Strong problem-solving skills, ownership mentality, and the ability to work independently on critical infrastructure.
English proficiency at C1 level or above.

WOULD BE A PLUS
Experience in cryptocurrency, digital assets, fintech, banking, payments, or other regulated financial services.
Familiarity with virtual asset regulatory requirements and the compliance expectations of regulated financial institutions.
Experience operating security-critical infrastructure for financial platforms or systems handling sensitive financial data.
Experience implementing security controls aligned with multiple compliance frameworks.
Experience with workload security, cloud security posture management, secrets management, and identity and access management.
Experience building security operations processes and establishing on-call rotations in a growing engineering team.

WORKING CONDITIONS & BENEFITS
Location: Dubai, UAE, with a hybrid working arrangement and regular office presence. Relocation could be considered.
Employment Type: Full-time, permanent contract.
Reporting Line: Direct reporting to the CTO.
Compensation: Competitive compensation based on experience.
Vacation: 20 working days per year.
Sick Leave: 10 days per year.
Days Off: 5 days per year.
Public Holidays: 8–10 days per year, depending on the holiday calendar of different countries.
Engineering Environment: Work with a small, highly skilled engineering team and modern cloud-native infrastructure without legacy systems.
Ownership & Impact: High autonomy and direct influence on infrastructure architecture, security standards, and engineering decisions.