DevSecOps engineer in cybersecurity

We are TBC, a leading financial institution in the region, where a bold and determined team fulfills our mission and makes people’s lives easier. We set new service standards through the use of data analysis, artificial intelligence, and digital products. We support you in developing, achieving your goals, and creating your success story—the most important thing is to believe. We are looking for a motivated DevSecOps Engineer to help us integrate security throughout the entire software development, delivery, and operations lifecycle.

• SSDLC: Integrate security controls at every stage of the SDLC; consider security requirements from the planning and architecture phases; introduce Shift Left Security, Security by Design, and Security by Default approaches; and support Development and DevOps teams in improving secure development processes and implementing best practices.
• CI/CD Security: Integrate security checks into CI/CD pipelines; introduce security controls and Quality Gates at the build, test, and deployment stages; assess the security of Service Accounts, Service Principals, Tokens, and other identities used in pipelines; and improve Branch Protection, Pull Request Approval, and Segregation of Duties controls to ensure secure and manageable software development processes.
• Application Security Testing: Introduce and manage SAST, DAST, SCA, and Secrets Scanning processes; assess vulnerabilities in Open Source components and risks related to licenses; develop Infrastructure as Code (IaC) and Configuration Scanning practices; and verify False Positive results and correctly classify security findings to ensure effective risk management.
• Vulnerability management: Analyze vulnerabilities identified in applications, containers, Cloud, and Kubernetes environments; set priorities based on business and technical risk; assess exploitability, internet accessibility, and asset criticality; develop Remediation Plans, monitor their implementation progress, and actively participate in Risk Acceptance processes.
• Container security: Assess security controls for Container Images and Registries; review Kubernetes RBAC, Service Account, Secret, Network Policy, and Workload Security configurations; integrate security requirements into Kubernetes Manifests and Helm Charts; and actively participate in introducing and developing Policy as Code, Admission Control, and security policies.
• Software Supply Chain Security: Assess the security of third-party libraries and packages; improve controls over the provenance and integrity of software components; participate in introducing and developing SBOM processes, Artifact Signing, and Verification; and reduce risks associated with using untrusted or unapproved components and strengthen Supply Chain security.
• Architecture, automation, and incident response: Assess the security of new projects and technology changes and conduct Threat Modeling; develop technical security standards, procedures, and guidelines; automate recurring security tasks; respond to incidents identified in code, CI/CD pipelines, and IaC configurations; and analyze their root causes.

• Knowledge of the software development lifecycle, CI/CD processes, and DevOps practices.
• Experience working with Git-based Source Code Management platforms.
• Knowledge of Linux operating systems and networking fundamentals.
• Knowledge of Authentication, Authorization, and Identity & Access Management concepts.
• Practical understanding of Docker, Container, and Kubernetes technologies.
• Scripting or programming experience.
• Ability to analyze security findings and communicate effectively with technical teams.
• Strong problem-solving skills.
• Motivated to develop and learn new things.
• Strong communication skills with both technical and non-technical people.
• Willingness to work with AI tools and modern technologies.
• Будет плюсом: Experience in any of the following areas: Cyber Security and Application Security; DevOps, Platform Engineering, or Cloud Security; Container and Kubernetes Security; Vulnerability Management and Security Automation; Software Supply Chain Security and Infrastructure as Code; Security architecture; Certifications in any of the following areas: Cyber Security, APPSEC, DevSecOps, Cloud Security, Kubernetes, Container Security, DevOps, Automation

• Условий в вакансии нет