DevSecOps Engineer II

Responsibilities

• Perform continuous security posture assessments across AWS, Azure and GCP environments and identify cloud misconfigurations, insecure configurations and deviations from security baselines.

• Conduct IAM and SSO access reviews, covering users, roles, groups, service accounts/service principals, permissions, access keys and privileged access, and identify excessive or stale access.

• Identify and assess publicly exposed cloud resources, insecure network configurations and unnecessary external exposure across compute, storage, databases, load balancers and other cloud services.

• Integrate security controls into CI/CD pipelines, including SAST, SCA, secrets scanning, Infrastructure-as-Code scanning, container/image scanning, DAST and software supply-chain controls.

• Perform Infrastructure-as-Code security reviews and support secure implementation of Terraform and similar technologies.

• Perform Kubernetes and container security assessments, including cluster configurations, Kubernetes RBAC, workload security, image security, hardening and security posture management.

• Analyse vulnerabilities and security findings, validate risks and false positives, prioritise remediation and work with Engineering/SRE/DevOps teams to drive findings through closure.

• Develop security automation using Python, Bash, cloud APIs and CLIs for IAM reviews, asset inventories, security assessments, compliance checks, monitoring, reporting and evidence collection.

• Review cloud network and edge security controls including VPC/VNet, Security Groups/firewalls, load balancers, WAF, TLS/mTLS and public/private connectivity.

• Monitor and review CloudSEK alerts and findings, perform initial analysis and validation, and coordinate remediation or escalation with relevant stakeholders.

• Support CloudSEK block-rule activities, including review and validation of relevant indicators, domains and URLs, and coordinate appropriate blocking actions with responsible teams.

• Support investigation of cloud and security alerts, exposed credentials, suspicious access, provider security notifications and other security events.

• Participate in cloud architecture and design security reviews and provide practical security recommendations based on risk, secure-by-design and least-privilege principles.

• Support security and audit requirements aligned with frameworks such as CIS, NIST, PCI DSS, ISO 27001 and OWASP.

• Develop and maintain security standards, SOPs, hardening guidelines, assessment methodologies, technical documentation and operational runbooks.

• Continuously identify opportunities to automate preventive and detective security controls and improve overall Cloud Security and DevSecOps maturity.

• Participate in broader Information Security activities including vulnerability management, security assessments, incident investigations, security reviews, audit/compliance.

Skills

To be successful in this role, you should have:

• Strong hands-on understanding of at least one major public cloud platform, preferably AWS, with working knowledge of Azure and/or GCP being an advantage.

• Good understanding of cloud security across IAM, compute, storage, networking, encryption, logging and monitoring.

• Knowledge of cloud security services such as AWS IAM/IAM Identity Center, Security Hub, AWS Config, CloudTrail, KMS and EKS, or equivalent services in Azure/GCP.

• Hands-on understanding of CI/CD and DevSecOps security, including SAST, SCA, DAST, secrets scanning, IaC scanning and container/image security.

• Experience with CI/CD technologies such as Jenkins, GitHub Actions, ArgoCD, Bitbucket Pipelines or equivalent platforms.

• Working knowledge of Terraform and Infrastructure-as-Code security.

• Good understanding of Docker, Kubernetes, Kubernetes RBAC, container security and cluster hardening.

• Experience with scripting and automation using Python, Bash or similar languages.

• Strong understanding of IAM, least privilege, MFA, privileged access, credential management and access governance.

• Understanding of CSPM, KSPM, CWPP and CNAPP concepts.

• Knowledge of cloud/network security concepts including VPC/VNet, Security Groups, firewalls, WAF, TLS/mTLS and private/public connectivity.

• Experience with security monitoring, alert triage and threat/exposure-management platforms such as CloudSEK or equivalent solutions.

• Exposure to security tooling such as Snyk or equivalent SAST/SCA, CSPM, container and infrastructure security solutions.

• Understanding of vulnerability management, risk-based remediation and security incident investigation.

• Knowledge of security standards and frameworks including CIS Benchmarks, NIST, PCI DSS, ISO 27001 and OWASP.

• Ability to independently analyse security findings, document security risks and provide clear and practical remediation recommendations to technical stakeholders.

Experience and Qualifications

• 3–6 years of relevant experience in Cloud Security, DevSecOps, Infrastructure Security, Platform Security or related security engineering roles.

• Strong hands-on technical experience in cloud security, infrastructure security, vulnerability management and security automation.

• Bachelor's degree in Computer Science, Information Technology, Cyber Security, Engineering or a related discipline, or equivalent relevant industry experience.

• Relevant cloud/security certifications such as AWS Certified Security – Specialty, AWS Solutions Architect, Certified Kubernetes Security Specialist (CKS), Microsoft Azure Security Engineer, Google Professional Cloud Security Engineer or equivalent are an added advantage.