As a Senior DevSecOps Platform Security Engineer, you will play a critical role in designing, implementing, and maintaining secure, scalable, and resilient cloud platforms (AWS and Kubernetes) and CI/CD pipelines. This position focuses on integrating security best practices throughout the SDLC, automating security controls, and responding to security incidents in an agile environment. You will work closely with development, operations, and security teams to foster a culture of security awareness and provide expert guidance on security-related matters.
What You’ll Do:
- Design, implement, and maintain secure AWS and Kubernetes platforms, ensuring high availability, scalability, and performance.
- Develop, implement, and automate security controls across the CI/CD pipeline, including static and dynamic analysis, vulnerability scanning, and compliance checks.
- Conduct security assessments, penetration testing, and code reviews to identify and mitigate vulnerabilities.
- Collaborate with development teams to embed security best practices early in the SDLC, providing guidance on secure coding and architecture design.
- Implement and manage security tools and technologies (e.g., WAF, IDS/IPS, SIEM, secrets management, identity and access management).
- Respond to security incidents, perform root cause analysis, and implement preventative measures.
- Stay up-to-date with the latest security trends, threats, and technologies, continuously improving our security posture.
- Participate in on-call rotations to support critical security infrastructure and incidents.
- Mentor junior engineers and promote a culture of security within the organization.
What You’ll Bring:
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- 8+ years of experience in DevSecOps, Platform Engineering, or a similar security-focused role.
- Deep expertise in AWS services (EC2, S3, VPC, IAM, Lambda, RDS, EKS, etc.) and Kubernetes security best practices.
- Proficiency in scripting and automation using languages like Python, Go, or Bash.
- Strong experience with CI/CD tools (e.g., Jenkins, GitLab CI, ArgoCD) and integrating security into automated workflows.
- Solid understanding of network security, firewalls, IDS/IPS, WAF, and VPNs.
- Experience with security tools such as SAST, DAST, IAST, vulnerability scanners, and SIEM solutions.
- Knowledge of compliance frameworks (e.g., SOC 2, HIPAA, ISO 27001) and experience implementing controls.
- Familiarity with infrastructure as code (IaC) tools like Terraform or CloudFormation.
- Excellent communication, collaboration, and problem-solving skills.
- Ability to work independently and as part of a cross-functional team in a fast-paced, agile environment.
