DevSecOps Engineer

Job Title: DevSecOps Engineer (Cloud Security & Compliance Focus)
We are seeking a highly motivated and security-conscious DevSecOps Engineer to join our team. You will be a critical part of our security and compliance efforts, ensuring the integrity and confidentiality of our systems and data. Your hands-on experience with Istio, Envoy, Kubernetes, and Terraform, coupled with your security penetration testing or automated API testing experience, makes you an ideal candidate to drive our security initiatives in a cloud-native environment.
Responsibilities:

• Security Architecture and Implementation:
  • Design and implement secure cloud-native architectures with a focus on Istio service mesh and Kubernetes container orchestration.
  • Harden and secure containerized workloads and microservices using best practices.
  • Leverage Terraform for infrastructure as code (IaC) deployments, ensuring security is baked into the process from the start.
  • Implement security controls and monitoring solutions to detect and respond to potential threats.
• Compliance and Security Auditing:
  • Collaborate with security and compliance teams to ensure adherence to industry standards and regulations.
  • Conduct regular security audits and penetration testing to identify vulnerabilities and recommend remediation strategies.
  • Develop and maintain documentation for security policies, procedures, and incident response plans.
• DevSecOps Integration:
  • Integrate security practices and tools into the CI/CD pipeline to automate security testing and vulnerability scanning.
  • Implement and maintain security tools for code analysis, dependency management, and vulnerability tracking.
  • Promote a culture of security awareness and collaboration within the development and operations teams.
• Incident Response:
  • Participate in incident response activities, including investigation, containment, and recovery.
  • Analyze security incidents and identify root causes to prevent future occurrences.

Qualifications:

• Hands-on Experience:
  • Strong practical experience with Istio service mesh, Envoy proxy, Kubernetes, and Terraform.
  • Proficiency in security penetration testing methodologies or automated API testing tools.
  • Familiarity with cloud security best practices and cloud-native technologies.
• Security and Compliance Knowledge:
  • Understanding of security principles, vulnerabilities, and mitigation techniques.
  • Knowledge of industry security standards and compliance regulations.
  • Experience in conducting security audits and vulnerability assessments.
• Passion for Security:
  • A strong desire to stay abreast of the latest security trends and technologies.
  • Enthusiasm for sharing knowledge and promoting security best practices within the team.
• Strong Communication and Collaboration:
  • Ability to effectively communicate complex security concepts to technical and non-technical stakeholders.
  • Excellent teamwork and collaboration skills, working effectively with cross-functional teams.

Additional Desirable Skills:

• Experience with cloud platforms such as AWS, Azure, or GCP.
• Programming/scripting skills (Python, Java, Bash, etc.)
• Certifications in security and cloud technologies (CISSP, CCSP, etc.)