Walk-in || Senior DevSecOps Administrator

Designation : Senior DevSecOps Administrator

Job Brief We are looking for a skilled and security-focused DevSecOps Administrator to join our cybersecurity team, responsible for embedding security into every stage of the software development lifecycle across our Azure and AWS cloud environments. This role combines cloud infrastructure and CI/CD pipeline engineering with hands-on application security testing, functional/manual testing, and vulnerability remediation, ensuring that applications and cloud workloads supporting our banking-sector operations are built, tested, and deployed securely and in compliance with organizational and regulatory requirements.

Roles and Responsibilities

Design, build, and maintain secure CI/CD pipelines (Azure DevOps, GitHub Actions, Jenkins, AWS Code Pipeline) with integrated security gates for code quality, dependency, secrets, and container scanning.

• Integrate and manage Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and secrets-detection tools within development workflows; triage findings and drive remediation with development teams.
• Perform manual and automated application security testing of web applications, APIs, and mobile applications, aligned with the OWASP Top 10, OWASP API Security Top 10, and OWASP ASVS.
• Conduct Vulnerability Assessment and Penetration Testing (VAPT) of applications and cloud infrastructure; validate findings, eliminate false positives, and document reproducible proof-of-concept evidence and remediation guidance.
• Execute manual functional, regression, integration, and User Acceptance Testing (UAT) support prepare test plans, test scenarios, and test cases; log, track, and retest defects through closure.
• Validate security controls during application testing, including authentication, authorization/access control, session management, input validation, encryption, and error handling.
• Administer and secure Azure and AWS environments IAM/Entra ID, RBAC, network security groups, security groups, VNets/VPCs, Key Vault/KMS, storage and database security configurations.
• Implement and enforce cloud security posture using Microsoft Defender for Cloud, AWS Security Hub, GuardDuty, AWS Config, and Azure Policy; remediate misconfigurations against CIS Benchmarks.
• Develop and maintain Infrastructure as Code (Terraform, ARM/Bicep, CloudFormation) with security scanning (Checkov, tfsec, or equivalent) to prevent insecure deployments.
• Secure containerized and Kubernetes workloads (AKS, EKS, Docker) — image scanning, admission policies, secrets management, and runtime hardening.
• Manage secrets, certificates, and keys using Azure Key Vault, AWS Secrets Manager, or HashiCorp Vault; eliminate hard-coded credentials from code and pipelines.
• Participate in secure design reviews and threat modelling (STRIDE) for new applications, features, and cloud architectures.
• Integrate pipeline, cloud, and application logs with SIEM/SOC platforms to support detection, investigation, and incident response.
• Prepare security test reports, vulnerability dashboards, and remediation-tracking metrics for development leads, management, and audit purposes.
• Support internal and external security audits, client due diligence, and regulatory reviews (ISO 27001, PCI-DSS, RBI IT Framework, DPDP Act, CERT-In) related to application and cloud security controls.
• Document and continuously improve secure coding guidelines, testing SOPs, runbooks, and DevSecOps standards; conduct secure coding awareness sessions for development teams.
• Coordinate with development, QA, infrastructure, and vendor teams to ensure timely closure of Critical/High findings within defined SLAs.

Requirements

• Bachelor’s or master’s degree in engineering, Computer Science, Information Technology or a related field.

• 4–6 years of hands-on experience in DevSecOps, cloud security, application security testing, and manual/functional testing

Strong hands-on experience with the following tools/platforms:

• Cloud Platforms: Microsoft Azure (Entra ID, AKS, App Service, Key Vault, Defender for Cloud, Azure Policy) and AWS (IAM, EC2, S3, EKS, Lambda, KMS, Security Hub, GuardDuty, CloudTrail).
• CI/CD & DevOps: Azure DevOps, GitHub/GitLab, Jenkins, Docker, Kubernetes, Terraform, ARM/Bicep, CloudFormation.
• Application Security Testing: Burp Suite Professional, OWASP ZAP, Postman, SonarQube, Checkmarx/Veracode/Snyk or equivalent SAST/SCA tools, Nmap, Nikto, SQLMap.
• Manual & Functional Testing: test case design, test execution, defect management (Jira, Azure Boards), regression and UAT support; exposure to automation frameworks (Selenium, Playwright) is an advantage.
• Strong understanding of OWASP Top 10, OWASP API Security Top 10, SANS/CWE Top 25, and common web vulnerabilities (injection, XSS, CSRF, IDOR, SSRF, broken authentication).
• Working knowledge of network protocols, OS security (Windows, Linux), and secure cloud architecture principles (least privilege, segmentation, Zero Trust).
• Knowledge of CVSS scoring, CVE prioritization, and risk-based vulnerability remediation approaches.
• Familiarity with SIEM/SOAR integration and log correlation for cloud and application telemetry.
• Familiarity with ISO 27001, PCI-DSS, DPDP Act, RBI IT Framework, CERT-In guidelines, NIST, and CIS Benchmarks.
• Scripting/automation skills (PowerShell, Python, Bash) for pipeline integration, testing, and reporting.
• Good written and verbal communication skills.
• Professional attitude with a customer-focused approach.
• Flexible to work in shifts and at different locations based on business requirements.

Certifications (At least one mandatory)

• Microsoft Certified: Azure Security Engineer Associate (AZ-500)
• AWS Certified Security – Specialty
• Certified DevSecOps Professional (CDP) or equivalent
• Certified Kubernetes Security Specialist (CKS)
• EC-Council Certified Ethical Hacker (CEH) / OSCP / eWPT / Burp Suite Certified Practitioner
• ISTQB Certified Tester – Foundation Level (CTFL)