DevSecOps Engineer

Traveloka; Jakarta Pusat; On-site; IDR 420,000,000 - 700,000,000; Full time

Job summary

Traveloka is seeking a DevSecOps Engineer to own and advance our secure development lifecycle across the build pipeline. You will define standards, drive secure coding, and implement automation at scale for CI/CD security, SCA/SAST integrations, and policy-as-code.

In this role, you will partner with engineering, product, and security leadership to balance risk with speed, apply AI security tools responsibly, and shape Traveloka's security architecture across dozens of engineers.

Qualifications

• You have at least 6 years of relevant experience in DevSecOps, application security, or secure SDLC engineering
• Designs and builds production-grade security tooling and automation (e.g. CI/CD security scanners, SCA/SAST integrations, policy-as-code) in Python or equivalent
• You have defined security standards or built security capabilities — such as vulnerability scanning, dependency/3rd-party library checks, or security rule validation — adopted across an entire engineering organisation
• You have driven the change management required to make them stick, including getting developer teams to adopt secure coding guidance during the build process
• You can weigh security, operational, and business trade-offs in your decisions and defend them with data, communicating clearly to both technical and business leadership
• You influence senior engineers and cross-functional leaders through credibility rather than authority
• You use AI security tools with sophistication, understanding their failure modes and shaping how they are adopted responsibly within developer workflows
• You have a bachelor’s degree in Computer Science, Information Security, or a related field
• You are the security engineer that engineering directors want in the room for the most consequential CI/CD and secure development architecture decisions
• You have defined pipeline security architecture at organizational scale and built security automation that measurably improved secure coding practices across hundreds of engineers

Responsibilities

• Own and drive the most complex, highest-impact SDLC security programs end-to-end, from scoping and embedding controls into CI/CD workflows through to remediation validation and organisational learning
• Define and enforce the technical standards, scanning methodologies, and tooling frameworks your function operates by — covering vulnerability detection in code and 3rd-party libraries — ensuring consistency, quality, and continuous improvement across all security work in the build pipeline
• Identify systemic gaps in secure coding practice and pipeline security coverage across the engineering organisation, and lead cross-functional improvement programs that produce lasting structural change in how Traveloka builds software securely
• Act as the senior technical authority in security discussions with engineering, product, and business leadership, providing the depth of reasoning and credibility that helps the organisation make sound, defensible decisions on security rules and build-time controls
• Influence engineering teams toward secure coding and design practices through deep technical credibility, shaping how security is embedded into Traveloka’s development workflows as an individual contributor
• Define how AI tools are adopted within secure development workflows, establishing the standards for responsible use and modeling the judgment that separates genuine security acceleration from risk amplification
• Define and own Traveloka’s CI/CD pipeline security architecture, setting the standards for how security controls are embedded across build workflows and ensuring coverage is consistent, reliable, and trusted by the engineering organisation
• Lead the design and delivery of the most complex security automation and tooling programs, producing capabilities that scale security feedback across hundreds of engineers and measurably improve secure development practices
• Shape Traveloka’s secure development culture at an organisational level, defining the security awareness strategy and developer guidance frameworks that make security a natural part of how engineering teams build

Skills

DevSecOps

Application security

Secure SDLC

Python

Education

Bachelor's degree in Computer Science or Information Security

Tools

CI/CD security scanners

SCA/SAST integrations

Policy-as-code

Job description

About Traveloka

Traveloka is Southeast Asia's leading travel and lifestyle super-app. We connect tens of millions of travellers across the region with flights, hotels, experiences, financial services, and more — all from a single platform. Since our founding in 2012, we have expanded to eleven markets, processed billions of dollars in transactions, and built one of the most recognised consumer brands in the region.

Job Description

Job ID: MJ000418

Traveloka is Southeast Asia's leading travel and lifestyle super-app. We connect tens of millions of travellers across the region with flights, hotels, experiences, financial services, and more — all from a single platform. Since our founding in 2012, we have expanded to eleven markets, processed billions of dollars in transactions, and built one of the most recognised consumer brands in the region.

We move fast because the region demands it. Southeast Asia is young, mobile-first, and growing faster than almost anywhere else on earth. We are not transplanting a Western playbook — we are writing a new one, from scratch, for a market that does not look like anywhere else — and we are calling for people who want to be part of that.

About The Team

Information Security at Traveloka protects one of Southeast Asia's largest travel platforms — millions of travellers, their payments, and their trust across 11 markets. We are the team that lets hundreds of engineers ship fast without shipping risk: building secure-by-default infrastructure, hunting threats in real time, and setting the standards every product team is held to. As we scale and as AI becomes native to how we build, the attack surface grows and our work only gets more critical.

Here you defend at genuine scale and own outcomes, not tickets. Whether you are hardening systems through security engineering or running detection and response in security operations, you will make decisions that move the whole company. If you want your security work to matter to real people across the region, you will fit right in.

As a DevSecOps Engineer, you are the technical authority for security within the software development lifecycle, driving the most complex security-in-pipeline programs, setting the standards your function operates by, and shaping how secure development is practiced across Traveloka as an individual contributor.

Job Scope

• Own and drive the most complex, highest-impact SDLC security programs end-to-end, from scoping and embedding controls into CI/CD workflows through to remediation validation and organisational learning
• Define and enforce the technical standards, scanning methodologies, and tooling frameworks your function operates by — covering vulnerability detection in code and 3rd-party libraries — ensuring consistency, quality, and continuous improvement across all security work in the build pipeline
• Identify systemic gaps in secure coding practice and pipeline security coverage across the engineering organisation, and lead cross-functional improvement programs that produce lasting structural change in how Traveloka builds software securely
• Act as the senior technical authority in security discussions with engineering, product, and business leadership, providing the depth of reasoning and credibility that helps the organisation make sound, defensible decisions on security rules and build-time controls
• Influence engineering teams toward secure coding and design practices through deep technical credibility, shaping how security is embedded into Traveloka’s development workflows as an individual contributor
• Define how AI tools are adopted within secure development workflows, establishing the standards for responsible use and modeling the judgment that separates genuine security acceleration from risk amplification
• Define and own Traveloka’s CI/CD pipeline security architecture, setting the standards for how security controls are embedded across build workflows and ensuring coverage is consistent, reliable, and trusted by the engineering organisation
• Lead the design and delivery of the most complex security automation and tooling programs, producing capabilities that scale security feedback across hundreds of engineers and measurably improve secure development practices
• Shape Traveloka’s secure development culture at an organisational level, defining the security awareness strategy and developer guidance frameworks that make security a natural part of how engineering teams build

Requirements

• You have at least 6 years of relevant experience in DevSecOps, application security, or secure SDLC engineering
• Designs and builds production-grade security tooling and automation (e.g. CI/CD security scanners, SCA/SAST integrations, policy-as-code) in Python or equivalent
• You have defined security standards or built security capabilities — such as vulnerability scanning, dependency/3rd-party library checks, or security rule validation — adopted across an entire engineering organisation
• You have driven the change management required to make them stick, including getting developer teams to adopt secure coding guidance during the build process
• You can weigh security, operational, and business trade-offs in your decisions and defend them with data, communicating clearly to both technical and business leadership
• You influence senior engineers and cross-functional leaders through credibility rather than authority
• You use AI security tools with sophistication, understanding their failure modes and shaping how they are adopted responsibly within developer workflows
• You have a bachelor’s degree in Computer Science, Information Security, or a related field
• You are the security engineer that engineering directors want in the room for the most consequential CI/CD and secure development architecture decisions
• You have defined pipeline security architecture at organizational scale and built security automation that measurably improved secure coding practices across hundreds of engineers

Join Us

If you have read this far and felt something click — the problem, the scale, the moment — we would like to hear from you.

We review every application. If your background is a strong fit, you will hear from us within 5 business days.

We are building the kind of company where strong people choose to stay because the work keeps getting bigger and better. If that is what you are looking for,