Senior DevSecOps Engineer

About the role

We are seeking a Senior DevSecOps Engineer to act as the primary technical reference for our projects and to lead initiatives that raise DevSecOps maturity across the organization.

Key responsibilities

• Lead initiatives to improve and enhance DevSecOps maturity across the organization.
• Conduct DevSecOps and Application Security maturity assessments using frameworks such as BSIMM 15, OWASP DSOMM, and OWASP DSOVS.
• Design, review, and coordinate the integration of security controls into CI/CD pipelines, including SAST, SCA, DAST, IAST, Secrets Management, and IaC scanning.
• Establish and govern vulnerability triage, prioritization, tracking, and remediation processes with defined SLAs.
• Lead the implementation, configuration, and optimization of application, API, and secure development security tools.
• Develop and maintain technical standards, documentation, security guidelines, templates, checklists, and operational runbooks.
• Provide technical mentorship and guidance to DevSecOps, cybersecurity, and software development teams.
• Monitor and report on Application Security KPIs, metrics, and DevSecOps maturity indicators.
• Support alignment of security policies and standards with global best practices and applicable local regulatory requirements.
• Promote secure software development practices throughout the Software Development Life Cycle (SDLC).

Required profile

• Minimum 7 years of relevant professional experience, including senior or lead‑level roles.
• Proven experience leading threat modeling, secure design reviews, and end‑to‑end implementation of security tools.
• Experience conducting maturity assessments using BSIMM and/or OWASP DSOMM, including evidence collection, gap analysis, and reporting.
• Experience defining, tracking, and reporting Application Security KPIs, metrics, and maturity indicators.
• Strong practical experience in secure software development and DevSecOps practices.
• Experience with CI/CD platforms such as GitLab, Azure DevOps, and/or CloudBees.
• Deep understanding of integrating security tools into the SDLC (SAST, SCA, DAST, IAST, Secrets Management, IaC scanning).

Required skills

• SAST
• SCA
• DAST
• IAST
• Secrets Management
• Infrastructure as Code (IaC) Scanning
• GitLab
• Azure DevOps
• CloudBees
• BSIMM
• OWASP DSOMM
• OWASP DSOVS
• Threat Modeling
• Secure Design Reviews