DevSecOps application security engineer in banking

Aubay Spain; Barcelona; Hybrid; EUR 60,000 - 90,000; Full time

Job summary

Aubay Spain is seeking a DevSecOps / AppSec Engineer to join an international banking project. You will implement secure CI/CD pipelines, manage vulnerabilities, and automate security workflows across Docker/OpenShift environments.

Required hands-on experience with SAST/DAST/SCA, scripting in Python or Bash, and knowledge of OWASP Top 10. Flexibility to work remotely/hybrid from Spain or France is offered.

Qualifications

• 3–4 years of IT experience with at least 2 years in Application Security, DevSecOps, or vulnerability management.
• Hands-on experience integrating SAST, DAST, and SCA tools into the SDLC.
• Strong scripting skills (Python, Bash) for automation in CI/CD pipelines.
• Knowledge of container security (Docker, OpenShift/Kubernetes).
• Familiarity with CVSS, OWASP Top 10, and threat landscapes.
• Fluent in English or French; strong communication with stakeholders.

Responsibilities

• Implement, automate, and maintain vulnerability detection in CI/CD workflows (SAST/DAST/SCA).
• Triage and remediate vulnerabilities in third-party libraries and frameworks.
• Develop scripts to automate dependency updates and security workflows.
• Secure deployments in OpenShift/Docker container environments.
• Define secure coding guidelines and report risk status and metrics to security management.
• Provide incident response support for critical vulnerabilities.

Skills

CI/CD security

Python scripting

Shell scripting

OpenShift/Kubernetes security

OWASP Top 10

Git/Jira

English or French communication

Tools

SonarQube

Checkmarx

OWASP ZAP

Docker

OpenShift

Kubernetes

Tenable/Qualys/Rapid7

Job description

Описание

About the project: We are looking for a DevSecOps / AppSec Engineer to join an international project in the banking sector. This initiative is at the core of our software security strategy and is responsible for managing vulnerabilities across all development and deployment pipelines. If you are passionate about the shift-left approach, automating security controls in CI/CD environments, and working directly with development teams to build secure software from the outset, this is the project for you.

Задачи

• Pipeline Security: Implement, automate, and maintain vulnerability detection tools (SAST, DAST, SCA) such as SonarQube, Checkmarx, and OWASP ZAP within CI/CD workflows.
• Triage and Remediation: Monitor, analyze, and prioritize vulnerabilities detected in third-party libraries, dependencies, and frameworks (npm, Maven, pip, Go modules).
• Automation: Develop scripts (Python, Bash) to automate dependency updates and security workflows.
• Container Security: Secure deployments in orchestrated environments, working closely with OpenShift and Docker.
• Reporting and Best Practices: Define secure coding guidelines, record compliance evidence in Jira, and report risk status and metrics to stakeholders and security management.
• Incident Response: Provide technical support for critical vulnerabilities (zero-day exploits, high-severity CVEs).

Требования

• Around 3-4 years of professional experience in IT, with at least 2 years of direct experience in Application Security, DevSecOps, or software-level Vulnerability Management.
• Hands-on experience integrating SAST, DAST, and SCA tools into the software development lifecycle.
• Strong scripting skills (Python, Bash) applied to automation in CI/CD pipelines.
• Knowledge and experience with container environments and their security (Docker, OpenShift/Kubernetes).
• Command of the threat landscape (OWASP Top 10, CWE) and vulnerability scoring methodology (CVSS).
• Fluent use of version control (Git/GitHub) and incident management (Jira).
• Ability to communicate fluently in English or French (proficiency in either one is sufficient).
• Будет плюсом: Knowledge of security in Cloud environments (AWS, Azure, or GCP); Experience with corporate vulnerability management platforms (Tenable, Qualys, Rapid7) and regulatory standards (ISO 27001, SOC 2); Industry certifications such as OSCP, CISSP, CEH, or CCSP

Условия

Join a banking-sector project in a mature, high-impact technology environment within a global leader. Flexibility to work from Spain or France (remote/hybrid).