Senior DevSecOps Engineer

Senior DevSecOps Engineer

The Senior DevSecOps Engineer will play a critical role in integrating security into software development and deployment processes, ensuring that security is embedded throughout the engineering lifecycle rather than treated as a final checkpoint. You will design and maintain secure CI/CD pipelines, strengthen build environments, and implement automated security controls across cloud infrastructure and application delivery workflows. Working closely with research and development (R&D), IT security, and compliance teams, you will help engineers identify and resolve vulnerabilities without compromising delivery speed. You will also oversee infrastructure-as-code security, container protection, and automated testing practices to improve the organization's overall security posture. This remote opportunity is ideal for an experienced technical professional who combines hands-on DevOps expertise with a strong security mindset. You will contribute to secure, reliable, and compliant technology operations within a highly regulated healthcare environment.

Accountabilities

• Secure CI/CD Pipeline Engineering: Design, implement, maintain, and continuously improve secure CI/CD pipelines, embedding security controls throughout the software development lifecycle, from code commits to production deployment.
• Automated Security Testing: Integrate and manage static application security testing (SAST), dynamic application security testing (DAST), dependency scanning, container scanning, and secrets management tools to detect and address vulnerabilities early.
• Build and Deployment Security: Harden build systems, artifact repositories, deployment tooling, and related infrastructure against common attack vectors, ensuring the integrity and security of software delivery processes.
• Infrastructure-as-Code Security: Review and improve infrastructure-as-code configurations, including Terraform, Kubernetes, and cloud resources, to enforce secure configuration standards and reduce infrastructure risks.
• Cloud and Container Security: Strengthen security controls across cloud environments and containerized workloads, applying best practices to Docker, Kubernetes, and relevant cloud-native services.
• Engineering Partnership: Serve as a security partner to R&D teams, helping developers understand vulnerabilities, prioritize remediation, and make informed security decisions without unnecessarily slowing development.
• Security Automation and Guardrails: Develop automated security checks, reusable tooling, and preventive controls that make secure engineering practices easier to adopt and integrate naturally into developer workflows.
• Architecture and Tool Assessment: Evaluate new tools, services, and technical architecture decisions for security implications, recommending appropriate safeguards before implementation or release.
• Compliance Alignment: Collaborate with IT security and compliance stakeholders to ensure that pipeline configurations, infrastructure changes, and software delivery practices align with applicable regulatory and security requirements.
• Incident Response Support: Assist with investigating and responding to security incidents involving build systems, deployment pipelines, cloud infrastructure, and production environments.
• Security Standards and Documentation: Establish, maintain, and communicate secure software development lifecycle standards, technical guidelines, and engineering best practices across teams.

Requirements

• Professional Experience: Approximately 7–8 years of experience in DevOps, platform engineering, or security engineering, with substantial hands-on experience in infrastructure management and software delivery pipelines.
• CI/CD Security Expertise: Demonstrated experience securing CI/CD pipelines and build systems, including implementing preventive controls and integrating security throughout the software development lifecycle.
• Cloud Infrastructure Knowledge: Strong practical experience with at least one major cloud platform, such as AWS, Microsoft Azure, or Google Cloud Platform (GCP).
• Infrastructure-as-Code Skills: Experience securing and managing infrastructure through Terraform or comparable infrastructure-as-code technologies, with an understanding of configuration risks and secure deployment practices.
• Containerization and Orchestration: Working knowledge of Docker, Kubernetes, and container security principles, including vulnerability assessment and secure configuration management.
• Application Security Tooling: Hands-on experience with SAST and DAST solutions, dependency and container scanning, secrets management, and other tools used to identify and mitigate software supply chain risks.
• Security Automation: Ability to develop scripts, automation workflows, or custom tooling that improves security enforcement and reduces manual effort across engineering processes.
• Compliance Awareness: Familiarity with security and compliance frameworks such as HIPAA, SOC 2, HITRUST, or GDPR. Experience in healthcare, financial technology, or another regulated industry is an advantage.
• Technical Communication: Strong written and verbal communication skills, with the ability to explain vulnerabilities, security trade-offs, and remediation approaches clearly to engineering and non-security stakeholders.
• Independent Working Style: Ability to manage responsibilities independently, exercise sound technical judgment, and prioritize competing tasks effectively.
• Critical Thinking: Strong analytical and problem-solving skills, with the ability to identify potential attack paths, assess risks, and develop practical security solutions.
• Preferred Certifications: Relevant certifications, such as AWS, Azure, or GCP security credentials, Certified Kubernetes Security Specialist (CKS), or equivalent qualifications, are advantageous.
• Work Schedule: Ability to work remotely from India and accommodate the required Monday-to-Friday schedule of 5:30 p.m. to 2:30 a.m. India Standard Time (IST).

Benefits

• Remote Work: Fully remote working arrangement from India.
• Annual Leave: 30 days of total leave per calendar year.
• Public Holidays: Annual public holidays in accordance with applicable policies.
• Healthcare Coverage: Medical insurance through a mediclaim policy.
• Lifestyle Rewards: Access to a lifestyle rewards program offering additional employee benefits.
• Financial Protection: Group term life insurance coverage.
• Retirement Benefits: Gratuity benefits in accordance with applicable policies and eligibility requirements.
• Professional Development: Opportunities to expand technical expertise in cloud security, DevSecOps, infrastructure automation, and secure software delivery.
• Collaborative Environment: Opportunity to work with engineering, IT security, and compliance professionals on meaningful security initiatives.
• Technical Impact: The chance to strengthen security practices across software development, cloud infrastructure, and production systems in a healthcare-focused technology environment.