Senior DevSecOps Engineer

Project description

DevSecOps Security Engineer role will have a major role to help implementing shift left security in DevSecOps program and define the required security guardrails. In addition, the role will cover leading a team of DevSecOps Security members (Security Testers and Risk Assessors) as those members will be working with dedicated teams of developers to perform many activities such as security scanning, penetration testing and risk assessment (threat modeling). Also establishing security champion program with secure code warrior.

Responsibilities

• Develop and update internal cyber security function processes for DevSecOps program
• Craft cyber security function requirements on the DevSecOps program: - Cybersecurity tools requirements and the integration to CI/CD pipelines to improve developer productivity, agility and code quality Prepare and present design and implementation documentation to multiple stakeholders. - Requirements for Application Security Orchestration & Correlation (ASOC) - Requirements for integrating all Application security tools (DAST , SAST, SCA, IAST, MAST and Threat Modeling) and vulnerability scanning tools ( Nexpose, Qualys, Nessus) with CI/CD tools
• Implementing Security Guardrails
• Mentor and coach junior-level DevSecOps security team member
• Work closely with cross-functional stakeholders to analyze and troubleshoot complex production issues.
• Collaborate closely with development teams to understand their current build and release processes and make recommendations for improvement.
• Partner with cross-functional stakeholders, including development, operations, quality assurance and security, to streamline processes.
• Provide guidance to development teams to improve performance and operability of the solutions they develop.
• Continuously improve automation idea to enable teams to secure code efficiently and consistently.
• Highlight automated testing requirements to reduce manual effort and improve product quality.

SKILLS

Must have

• Skills & Experience Essential
• 10+ years software engineering and technology delivery experience.
• Strong hands-on development background with evidence of significant code contributions.
• Expertise in: o Java o Spring Framework / Spring Boot o CI/CD pipelines o Git-based development o Cloud platforms like GCP
• Experience managing enterprise vulnerability programmes.
• Strong understanding of: o OSS Vulnerability Management o Veracode o Secure SDLC o DevSecOps o Application Security o Cyber Hygiene controls o Security risk management
• Proven ability to coordinate large-scale remediation programmes across multiple applications and teams.
• Strong stakeholder management experience working with senior technology and security leadership. ________________________________________ Preferred
• Experience in financial services or highly regulated environments.
• Security certifications such as: o CISSP o CSSLP o GIAC o AWS/Azure Security certifications
• Experience implementing security tooling and automation at scale.
• Experience leading technology modernisation and upgrade initiatives. ________________________________________ Success Measures The role will be measured against:
• Reduction in Critical and High vulnerabilities.
• Elimination of overdue vulnerabilities.
• Reduction in vulnerability ageing profile.
• Renovate adoption across Treasury repositories.
• Veracode compliance and policy adherence.
• Cyber Hygiene compliance improvements.
• Reduction in manual remediation effort through automation.
• Increased percentage of vulnerabilities remediated within SLA.
• Improved Treasury Technology security posture and audit outcomes.

Nice to have

Banking Domain