DevSecOps Engineer

Profile we are looking for

• We are seeking a person with a broad technical vision, capable of combining deep expertise in cloud and infrastructure with a strong focus on security and software development.
• Ability to define realistic security standards and controls, support teams, and balance autonomy, control, security, and efficiency.
• A mindset of continuous improvement, automation, measurement, and risk management.
• Organizational skills to track the remediation of detected security vulnerabilities, coordinating the involved teams until their resolution.

Essential requirements

• University degree or equivalent experience in computer engineering or related fields.
• Minimum of 3 years of experience with AWS: EC2, RDS, S3, ELB/ALB, ECR, VPC, or other equivalent services.
• Demonstrable experience in DevSecOps: integrating security controls into CI/CD pipelines (AWS CodePipeline, Jenkins, Bitbucket, etc.).
• Experience with SAST/SCA tools (SonarQube or equivalents) and defining security gates.
• Knowledge of cloud security and posture management (CSPM), preferably with Prisma Cloud or equivalent industry tools.
• Minimum of 2 years of experience with Infrastructure as Code (preferably Terraform) and container orchestration (AWS ECS, Docker, Kubernetes, or Nomad).
• Advanced knowledge of Git (preferably Bitbucket) and a B2 level of English.

Valuable knowledge

• Experience with pentesting tools (Pentera or equivalents), vulnerability management, and incident response.
• Knowledge of security frameworks and standards: OWASP (Top 10, ASVS), ISO 27001, or NIST.
• Security certifications (AWS Security Specialty, CompTIA Security+, CEH, OSCP, …).
• Observability (Grafana, Datadog, Prometheus, OpenTelemetry), programming languages (Java, Node.js, Python), and Confluent/Kafka.

We are looking for a DevSecOps Engineer to join the Technology Architecture team within their IT department.

The selected person will play a key role in integrating security throughout the entire software development lifecycle, defining standards, automated controls, and testing. The role requires technical judgment, a focus on continuous improvement, and the ability to propose secure, efficient, and scalable cloud solutions.

Our client is accelerating application development and increasing the number of IT teams and vendors, which entails new challenges in governance, support, standardization, and security.

In parallel, the evolution towards microservices architectures brings flexibility and scalability but also expands the attack surface, requiring strengthened security, reliability, deployment configuration, and observability.

The person will join the Architecture team to define, evolve, and oversee the company's DevSecOps model, working transversally with Development, QA, and Infrastructure teams to embed security into the delivery process from design through production.

• Integrate security into the software development lifecycle (SDLC) and CI/CD pipelines, applying a "shift-left" approach and "security as code" principles.
• Define secure standards, archetypes, and methodologies for application deployments, and periodically verify compliance with them.
• Configure and govern Static Application Security Testing (SAST) with SonarQube in conjunction with the QA team, integrating it into the pipelines and defining quality and security gates.
• Manage the Cloud Security Posture Management (CSPM) strategy with the Infrastructure team using Prisma Cloud (or other equivalent industry tools), ensuring compliance with AWS best practices.
• Coordinate and execute automated penetration testing (pentesting) with Pentera, prioritizing and tracking the remediation of findings.
• Implement additional security controls in the pipelines: Software Composition Analysis (SCA), secret detection, and container image scanning for containers and Infrastructure as Code (IaC).
• Oversee and improve Infrastructure as Code (IaC) using Terraform and AWS architectures, and promote security observability and monitoring (metrics, logs, traces, and alerts).
• Evaluate DevSecOps trends and tools through proof of concept (PoC) and disseminate security best practices among development teams.