DevSecOps Engineer

Responsibilities:

• Support security and compliance initiatives across services.
• Collaborate with development and operations teams to mitigate security risks.
• Implement and monitor security controls and compliance processes.
• Contribute to risk assessments, gap analyses, and remediation planning.
• Support internal and external audits by providing evidence and documentation.
• Support adherence to regulatory standards such as FedRAMP, HIPAA, GDPR, SOC 2 PCI, ISO27K, NIST, ISMAP, ENS, HITRUST, etc.
• Drive improvements in patch management, vulnerability management, and access control.
• Maintain accurate asset inventories and ensure configuration management best practices.
• Monitor logs and systems for anomalies and respond to incidents.
• Participate in penetration testing and threat modelling exercises.
• Communicate security requirements and findings to technical and non-technical stakeholders.
• Manage vulnerabilities for the service and work with the service team to ensure timely remediation of identified vulnerabilities.
• Serve as the audit focal point and review artefacts for various audit programs.
• Coordinate with internal teams and both internal and external auditors to ensure compliance with regulatory requirements and industry best practices.
• Conduct risk assessments, identify gaps, and provide recommendations for risk mitigation and process improvements.
• Conduct process analysis to identify manual tasks suitable for automation, and collaborate with teams to document requirements for automation projects.

Skills

DevOps, DevSecOps, FedRAMP, GDPR, HIPAA, HITRUST, NIST, SecOps, audit, compliance, risk, security, vulnerability