Security Engineer (DevSecOps & Infrastructure Security)

About the role

We are looking for a hands‑on Senior Security Engineer to own security across our software development lifecycle and infrastructure. Reporting to the CTO, you will drive a security‑first culture by implementing, managing, and operating security solutions in production.

Key responsibilities

• Implement and manage SAST, DAST, SCA and container scanning tools (e.g., SonarQube, Snyk, Semgrep, Trivy).
• Conduct threat modeling, security reviews and maintain secure coding standards (OWASP Top 10).
• Secure CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins) with automated compliance checks, SBOM generation and IaC scanning (Terraform).
• Deploy and operate secrets management (HashiCorp Vault, AWS Secrets Manager) and enforce Zero‑Trust principles.
• Administer Active Directory, Group Policy, certificates and secure remote access (ZTNA, VPN).
• Design secure network architecture, manage next‑gen firewalls (SonicWall, Fortinet, Palo Alto) and endpoint protection (CrowdStrike, Microsoft Defender).
• Secure cloud environments (AWS, Azure, GCP) and Cloudflare services (WAF, DDoS protection).
• Implement centralized logging, SIEM integrations (Sentinel, Splunk, Elastic) and lead incident response activities.

Required profile

• Strong hands‑on experience in DevSecOps and production security operations.
• Practical expertise in IT infrastructure, networking, Active Directory and cloud platforms.
• Ability to work independently, collaborate with engineering, DevOps and IT teams, and mentor junior staff.

Required skills

• SAST/DAST/SCA tools: SonarQube, Snyk, Semgrep, Trivy.
• CI/CD platforms: GitHub Actions, GitLab CI, Jenkins.
• IaC and policy‑as‑code: Terraform, OPA/Rego.
• Secrets management: HashiCorp Vault, AWS Secrets Manager.
• Zero‑Trust, MFA, least‑privilege access controls.
• Active Directory, Group Policy, certificates.
• Network security: VLANs, firewalls (SonicWall, Fortinet, Palo Alto), DNS, TLS.
• Endpoint protection: CrowdStrike, Microsoft Defender, BitLocker.
• Cloud platforms: AWS, Azure, GCP.
• Cloudflare security services.
• SIEM: Microsoft Sentinel, Splunk, Elastic.
• Incident response and security monitoring.