DevSecOps Engineer, Rimes Technologies

• Experienced in DevOps or platform engineering with a strong security mindset
• Hands-on experience with at least one CI/CD platform (Azure DevOps preferred)
• Good understanding of application security principles (OWASP Top 10, SANS/CWE Top 25)
• Experience integrating or running security scanners: SAST, SCA, DAST, container scanning, IaC scanning
• Experience with infrastructure as code (Terraform, ARM/Bicep, Helm)
• Familiar with cloud security (preferably Azure) and container security best practices
• Capable of supporting vulnerability management processes and remediation workflows
• Ability to collaborate with Software Engineering, DevOps, SRE, Cloud and Security teams
• Strong communicator able to translate risk into engineering friendly language

Desirable

• The DevSecOps Engineer role has been created to embed security into our engineering, DevOps and cloud delivery pipelines
• Working closely with our Development, DevOps, Infrastructure and Security teams, you will engineer, automate and maintain security controls across our CI/CD pipelines, cloud workloads and application lifecycle
• This position is critical in uplifting our secure by design practices, reducing vulnerabilities, and ensuring our rapidly evolving development environments adhere to best-in-class security standards
• (Infosec presentations highlight the explicit gap for DevSecOps capability and security integration into Dev and Cloud projects)
• Integrate security controls into CI/CD pipelines (Azure DevOps, GitHub Actions, Jenkins or equivalent)
• Implement automated SAST, SCA, DAST, container scanning and secrets management controls. (Referenced in secure development lifecycle expectations.)
• Work with Development and DevOps teams to ensure secure design principles, threat modelling and secure coding practices are embedded early in the lifecycle
• Engineer and maintain tooling for vulnerability management across code, containers, pipelines and cloud workloads
• Automate security guardrails across Azure resources, Kubernetes clusters, API gateways, serverless workloads and service meshes
• Support and enhance the deployment of security policies (IAM, key vaults, network controls, hardening baselines)
• Partner with engineering squads to review architecture changes and ensure security requirements are addressed
• Contribute to incident response activities where application or pipeline security is implicated
• Contribute to uplift of our secure engineering policies, developer training and SSDLC processes. (Supports expectations stated in internal assessments and training docs)