DevSecOps Engineer/Lead

Ajaib; Indonesia; On-site; IDR 279,000,000 - 446,400,000; Full time

Job summary

Dormont Manufacturing Co is looking for a skilled DevSecOps professional to enhance security practices in Indonesia's financial technology space. In this role, you will manage security tools and automate processes in CI/CD pipelines to ensure robust application security.

The ideal candidate will have extensive experience in application security tools, cloud technologies, and a strong coding background. Join us to create transformative solutions for financial inclusion!

Qualifications

• 4+ years in DevOps or application security with 2+ years in DevSecOps.
• Proficient with application security tools like Checkmarx and Snyk.
• Solid understanding of containerization and cloud-native infrastructure.

Responsibilities

• Integrate tools for security automation in CI/CD pipelines.
• Configure and optimize AppSec platforms.
• Perform security testing using automated scanners and manual techniques.

Skills

DevSecOps practices

CI/CD automation

Burp Suite Professional

Snyk

Docker

Kubernetes

Tools

Checkmarx

Semgrep

SonarQube

Job description

Key Responsibilities

• Pipeline Security Automation: Integrate and manage static, dynamic, and software composition analysis tools into continuous integration and continuous deployment (CI/CD) pipelines.
• Tooling Optimization: Own, configure, and fine‑tune AppSec platforms including Checkmarx, Semgrep, Snyk, and SonarQube to minimize false positives and maximize actionable alerts.
• Automated & Manual DAST: Configure automated dynamic scanners and leverage Burp Suite Professional for targeted security testing on APIs and web services.
• Vulnerability Remediation & Triage: Act as the primary technical point of contact to triage code vulnerabilities, providing clear remediation guidance and proof‑of‑concept fixes directly to engineering teams.
• Open Source Security (SCA): Utilize Snyk and similar tools to monitor open‑source dependencies, license compliance, and third‑party software supply chain vulnerabilities.
• Policy Enforcement: Define automated gatekeeping thresholds (e.g., failing builds for critical/high vulnerabilities) within the deployment pipeline based on internal security policies.

Requirements

• Experience: 4+ years of experience in DevOps, software engineering, or application security, with at least 2+ years dedicated exclusively to DevSecOps practices.
• Tooling Command: Proven, deep technical proficiency with the following tools:
  • SAST: Checkmarx, Semgrep, SonarQube
  • SCA & Container Security: Snyk
  • DAST / Pen‑testing: Burp Suite Professional
• CI/CD Ecosystems: Extensive experience building automation plugins and pipelines in GitHub Actions, GitLab CI, Jenkins, or Bitbucket Pipelines.
• Infrastructure as Code (IaC): Solid understanding of cloud‑native infrastructure, containerization (Docker, Kubernetes), and secure IaC deployment (Terraform).
• Development Background: Ability to read and understand code snippets across multiple languages (e.g., Python, Java, Go, Node.js).
• Certifications: Certifications such as Certified DevSecOps Professional (CDP), Practical DevSecOps (CDEP), or CSSLP are highly preferred.

Benefits

Join us as we make magic happen to increase Indonesia’s financial inclusion!