Senior DevSecOps

INFOBUS Holding is an international product IT company in the travel industry. We develop INFOBUS.eu, a platform for booking bus, train, and flight tickets, and BusSystem.eu, a SaaS solution for carriers.
We are looking for a Senior DevSecOps / Security Engineer to build a cybersecurity program around our existing infrastructure: assess risks, implement technical safeguards, establish continuous monitoring, and develop an incident response process. This is a hands-on role covering the full implementation cycle, from assessment and solution design to configuration, deployment, and validation.

Your responsibilities:
Assess the security of websites, APIs, infrastructure, access controls, and data; develop a risk register and remediation plan aligned with business priorities.
Design and implement technical security controls, defining how they will be maintained and monitored.
Configure and maintain Cloudflare, WAF, rate limiting, and bot management rules; investigate suspicious traffic while preserving access for users, partners, and legitimate search engine crawlers.
Introduce security scanning for code, dependencies, secrets, and running applications; integrate checks into CI/CD, validate findings, and coordinate vulnerability remediation.
Work with DevOps to strengthen the security of servers, network equipment, cloud services, and databases through access controls, secrets management, logging, and secure configurations.
Set up security event collection and alerting, develop incident response procedures, participate in investigations, and address root causes to prevent recurring incidents.
Define endpoint security requirements, including protective tools, updates, and configurations; coordinate implementation with IT support.
Support technical audit readiness by implementing required security controls and preparing evidence of their operation.
Document configurations and procedures, train internal specialists, and transfer knowledge to support ongoing maintenance.
What we are looking for:
Hands-on experience implementing security solutions independently, from design through production deployment.
Strong knowledge of Linux, networking, HTTP/HTTPS, TLS, DNS, access management, and server configurations.
Experience securing cloud and on-premises infrastructure, with the ability to work with GCP.
Experience with Cloudflare or comparable solutions, including WAF, DDoS protection, bot management, and traffic analysis.
Experience automating security checks and integrating security tools into CI/CD.
Understanding of web application, API, database, and personal data storage security.
Experience analyzing security events and responding to incidents.
Ability to translate security requirements into specific technical configurations and actionable tasks.
A proactive, independent approach, with the ability to prioritize business risks, communicate technical issues clearly, and coordinate changes across teams.
Nice to have:
Experience preparing a company for an ISO 27001 audit from a technical perspective.
Experience implementing technical controls to protect personal data.
What this role offers:
The opportunity to build a comprehensive cybersecurity program for an international product company.
Influence over security tooling and technical approaches.
Work across a customer-facing platform, external APIs, a SaaS product, and cloud and on-premises infrastructure.
Direct collaboration with the CTO and close cooperation with technical and business teams.
Send us your CV — we would be happy to discuss your experience and the opportunity to join INFOBUS!