Senior DevSecOps Engineer: Secure SDLC & CI/CD Leader

Traveloka; Jakarta Pusat; On-site; IDR 420,000,000 - 700,000,000; Full time

Job summary

Traveloka is seeking a DevSecOps Engineer to own and advance our secure development lifecycle across the build pipeline. You will define standards, drive secure coding, and implement automation at scale for CI/CD security, SCA/SAST integrations, and policy-as-code.

In this role, you will partner with engineering, product, and security leadership to balance risk with speed, apply AI security tools responsibly, and shape Traveloka's security architecture across dozens of engineers.

Qualifications

• You have at least 6 years of relevant experience in DevSecOps, application security, or secure SDLC engineering
• Designs and builds production-grade security tooling and automation (e.g. CI/CD security scanners, SCA/SAST integrations, policy-as-code) in Python or equivalent
• You have defined security standards or built security capabilities — such as vulnerability scanning, dependency/3rd-party library checks, or security rule validation — adopted across an entire engineering organisation
• You have driven the change management required to make them stick, including getting developer teams to adopt secure coding guidance during the build process
• You can weigh security, operational, and business trade-offs in your decisions and defend them with data, communicating clearly to both technical and business leadership
• You influence senior engineers and cross-functional leaders through credibility rather than authority
• You use AI security tools with sophistication, understanding their failure modes and shaping how they are adopted responsibly within developer workflows
• You have a bachelor’s degree in Computer Science, Information Security, or a related field
• You are the security engineer that engineering directors want in the room for the most consequential CI/CD and secure development architecture decisions
• You have defined pipeline security architecture at organizational scale and built security automation that measurably improved secure coding practices across hundreds of engineers

Responsibilities

• Own and drive the most complex, highest-impact SDLC security programs end-to-end, from scoping and embedding controls into CI/CD workflows through to remediation validation and organisational learning
• Define and enforce the technical standards, scanning methodologies, and tooling frameworks your function operates by — covering vulnerability detection in code and 3rd-party libraries — ensuring consistency, quality, and continuous improvement across all security work in the build pipeline
• Identify systemic gaps in secure coding practice and pipeline security coverage across the engineering organisation, and lead cross-functional improvement programs that produce lasting structural change in how Traveloka builds software securely
• Act as the senior technical authority in security discussions with engineering, product, and business leadership, providing the depth of reasoning and credibility that helps the organisation make sound, defensible decisions on security rules and build-time controls
• Influence engineering teams toward secure coding and design practices through deep technical credibility, shaping how security is embedded into Traveloka’s development workflows as an individual contributor
• Define how AI tools are adopted within secure development workflows, establishing the standards for responsible use and modeling the judgment that separates genuine security acceleration from risk amplification
• Define and own Traveloka’s CI/CD pipeline security architecture, setting the standards for how security controls are embedded across build workflows and ensuring coverage is consistent, reliable, and trusted by the engineering organisation
• Lead the design and delivery of the most complex security automation and tooling programs, producing capabilities that scale security feedback across hundreds of engineers and measurably improve secure development practices
• Shape Traveloka’s secure development culture at an organisational level, defining the security awareness strategy and developer guidance frameworks that make security a natural part of how engineering teams build

Skills

DevSecOps

Application security

Secure SDLC

Python

Education

Bachelor's degree in Computer Science or Information Security

Tools

CI/CD security scanners

SCA/SAST integrations

Policy-as-code

Job description

Traveloka is seeking a DevSecOps Engineer to own and advance our secure development lifecycle across the build pipeline. You will define standards, drive secure coding, and implement automation at scale for CI/CD security, SCA/SAST integrations, and policy-as-code.

In this role, you will partner with engineering, product, and security leadership to balance risk with speed, apply AI security tools responsibly, and shape Traveloka's security architecture across dozens of engineers.