Senior DevSecOps Engineer, Airalo

• Bachelor's degree in Computer Science, Cybersecurity, or a related field
• 5+ years of experience in DevSecOps, Security Engineering, or a similar role with a strong focus on cloud security
• 3+ years of hands-on experience with AWS services, including expertise in container orchestration, IAM, and security best practices
• 2+ years of experience with Kubernetes, including securing Kubernetes clusters and deployments
• Deep understanding of SAST, DAST, and container security solutions, and API security testing tools, along with experience implementing and managing these tools
• Proven experience in vulnerability assessment, threat modelling, and remediation techniques
• Experience with security incident response, including developing incident response plans and conducting post-mortems
• Proficiency in at least one programming language (Python, Go, Java, etc.) for automation and tooling
• Proficiency in infrastructure-as-code tools (e.g., Terraform) and CI/CD platforms (e.g., GitHub Actions, Jenkins)
• Excellent communication and collaboration skills with the ability to work effectively in a fast-paced environment

Desirable

• As our Senior DevSecOps Engineer, you will be the guardian of Airalo’s global infrastructure and applications
• This isn't just about maintaining compliance, it’s a hands-on opportunity to spearhead our shift-left security strategy, centralise AWS governance, and proactively outsmart malicious attacks
• If you are excited to design robust defences that slash attack vectors by 50% while scaling a secure ecosystem for millions of travellers, this is your chance to take true technical ownership
• Design, implement, and manage security solutions across the entire software development lifecycle (SDLC), with a focus on automation and continuous integration/continuous delivery (CI/CD) pipelines, including robust API security measures and authentication protocols
• Champion security best practices within engineering, DevOps, SRE, and IT teams, fostering a culture of shared responsibility for security
• Proactively identify and remediate security vulnerabilities in applications, mitigating OWASP Top 10 vulnerabilities, infrastructure, and cloud services through threat modelling, vulnerability assessments, and penetration testing
• Develop and maintain security monitoring and alerting solutions to detect and respond to potential security incidents in real-time and prevent common cyber attacks such as DDoS, injection attacks, and credential stuffing
• Define and enforce secure coding standards and provide training and mentorship to development teams on DevSecOps principles
• Lead compliance initiatives by contributing to security policies, controls, and audit readiness for SOC 2, ISO 27001, GDPR, and other relevant regulations
• Participating in our on-call rotation is a core expectation of this role. It's essential for maintaining 24/7 service reliability across our global operations, ensuring our systems remain resilient and our customers experience uninterrupted service, regardless of time zone or geography
• Paid Rotation: We offer standby fees + overtime pay
• Delayed Start: No on-call duties for your first 6 months
• Rest & Recovery: Guaranteed rest periods and flexible hours following night incidents
• Shared Load: Rotations are split (Weekdays vs. Weekends) to minimize fatigue
• Please refer to the On-Call Policy in the Airalo Handbook for full details: airalo-public.notion.site/our-approach-to-engineering-on-call-policy