Cyber Security Analyst: DevSecOps & Cloud Resilience

Gulf Air; Bahrain; On-site; BHD 13,000 - 27,000; Full time

Job summary

Gulf Air is strengthening its cyber security team to implement and enhance controls across cloud, applications, and DevOps pipelines. You will monitor risks, enforce secure coding practices, and collaborate with cross-functional teams to improve resilience while securing operations.

The role involves threat modeling, secret management, and securing APIs/microservices, with a focus on secure DevOps and incident response in a hybrid cloud environment.

Qualifications

• Experience designing and maintaining automated security checks in CI/CD pipelines (SAST/DAST/SCA).
• Collaborates with developers to enforce secure coding standards and conduct code reviews.
• Monitors cloud security alerts across AWS/Azure/Oracle and uses Defender/GuardDuty CSPM findings.
• Reviews Terraform IaC for misconfigurations and enforces security by design.
• Enforces container security with image scanning, runtime protection, and pod policies.
• Implements secrets management across environments.
• Performs SIEM/XDR/IDS/IPS monitoring and incident response.
• Leads threat modeling sessions with teams to mitigate risks.
• Acts as security liaison and conducts DevSecOps training.
• Assesses APIs and microservices security with gateways and OAuth/JWT.

Responsibilities

• Design, implement, and maintain automated security checks in CI/CD pipelines.
• Partner with developers to enforce secure coding standards and perform code reviews.
• Monitor cloud security alerts and triage CSPM findings by severity.
• Review IaC templates for misconfigurations before deployment.
• Enforce container security with image scanning and Kubernetes policies.
• Govern secrets management to prevent hardcoded credentials.
• Monitor SIEM/XDR/IDS/IPS and respond to incidents promptly.
• Conduct threat modeling with development and infrastructure teams.
• Deliver security training and foster shared DevSecOps responsibility.
• Assess APIs and microservices security with API gateway controls and OAuth/JWT.

Skills

Threat Detection and Response

Vulnerability Management

Privilege Access Management

Security Automation and Orchestration

DevSecOps

Security Hardening and Compliance

Cloud Security

Network Security

Endpoint Security

Education

Bachelor's degree in Computer Science, Information Technology, Cybersecurity

Tools

Microsoft Defender XDR

Microsoft Sentinel

Microsoft Defender for Cloud

Microsoft Defender for Endpoint

Nessus

Qualys

OpenVAS

Wallix

CyberArk

BeyondTrust

Python

Splunk Phantom

Cortex XSOAR

Azure Sentinel

GitHub Actions

AWS CodePipeline

Palo Alto Networks

Fortinet

Cisco ASA

Snort

Suricata

CrowdStrike Falcon

SentinelOne

AWS Security Hub

Azure Security Center

Defender for Cloud

Job description

Gulf Air is strengthening its cyber security team to implement and enhance controls across cloud, applications, and DevOps pipelines. You will monitor risks, enforce secure coding practices, and collaborate with cross-functional teams to improve resilience while securing operations.

The role involves threat modeling, secret management, and securing APIs/microservices, with a focus on secure DevOps and incident response in a hybrid cloud environment.