DevSecOps Engineer, INSTANDA

• Passion for Security
• Proven experience in a DevSecOps role or similar
• Strong understanding of Azure DevOps, CI/CD practices
• Familiarity with Azure services, including Azure Defender, Azure Monitor, and Azure Policy
• Experience with security and compliance scanning tools such as vulnerability scanners, intrusion detection systems, & security information & event management (SIEM) solutions
• Knowledge of container management with Azure Container Registry
• Experience in SAST, DAST & other techniques to improve code security

Desirable

• We are looking for a DevSecOps Engineer to join our growing DevOps Engineering team
• Security Integration in CI/CD Pipelines: Implement security controls within CI/CD pipelines using automation and best practices, ensuring vulnerabilities are caught early in the development cycle
• Infrastructure as Code (IaC) Security: Secure the infrastructure by applying security measures to IaC tools such as Terraform and Ansible
• Container Security: Ensure that containers (Docker, Kubernetes) are secured by configuring appropriate policies, scanning for vulnerabilities, and managing runtime security
• Cloud Security: Design, implement, and manage security across Azure, focusing on identity management, data protection, and network security
• Vulnerability Management: Identify and prioritize vulnerabilities across infrastructure and applications, and collaborate with teams to remediate them in a timely manner
• Threat Modelling and Risk Assessment: Perform threat modelling to identify security risks and provide recommendations for mitigation
• Monitoring and Incident Response: Develop and maintain monitoring systems and respond to security incidents quickly and effectively
• Automated Security Testing: Integrate and manage SAST, DAST, and other security testing tools to identify security issues in code and applications
• Compliance and Governance: Develop and manage Azure policies to ensure compliance with security standards and regulations (ISO 27001, SOC 2, GDPR) across our infrastructure
• Collaboration: Work closely with development, operations, and security teams to build a culture of security and ensure it is embedded in all phases of the development process
• Security Awareness: Provide mentorship and training to teams on secure coding practices, best security practices, and emerging security threats
• Security Integration: Integrate Azure Defender and other security tools to enhance our cloud security posture