Senior Application Security Engineer (DevSecOps)

About the role

You will work at an early‑stage health‑tech SaaS startup in Saudi Arabia, owning the GCP infrastructure and the security of the platform. You will define how code reaches production, how clinics are provisioned with isolated data, and who can access what.

Key responsibilities

• Design, implement and maintain a secure CI/CD pipeline in GitLab, including hardened runners and secret management.
• Establish a unified identity and access management system across GitLab, GCP and internal tools, with role‑based access and automated onboarding/offboarding.
• Manage tenant onboarding pipelines that provision, configure and segregate client data from day one.
• Implement infrastructure‑as‑code using Terraform for the entire estate, enabling reproducible environments.
• Set up audit and detection mechanisms to log all access to systems and patient records, with tamper‑evident storage and alerting.
• Provide observability and on‑call support for .NET and Python services, defining SLOs and handling incidents.
• Operate PostgreSQL clusters with pooling, replicas, failover and regular restore drills.

Required profile

• 5+ years of experience delivering production‑grade multi‑tenant B2B SaaS platforms.
• Proven track record designing and enforcing least‑privilege access for engineering teams.
• Deep hands‑on experience with GCP services such as Cloud Run, Cloud SQL, VPC, IAM, Secret Manager and workload identity.
• Production‑level Terraform usage, codifying existing infrastructure.
• Extensive experience building and maintaining GitLab CI/CD pipelines.
• Strong PostgreSQL operational skills, including pooling, replication and failover.
• Ability to write code in Python or C# to contribute directly to merge requests.
• High proficiency in English communication and ability to work in cross‑functional teams.

Required skills

• Google Cloud Platform (Cloud Run, Cloud SQL, VPC, IAM, Secret Manager, Workload Identity)
• Terraform
• GitLab CI/CD
• PostgreSQL
• Python
• C# / .NET
• Kafka or Pub/Sub (nice to have)