Application Security (AppSec) / DevSecOps Engineer

FyerX Global Private Limited; India; Remote; INR 1,200,000 - 1,800,000; Part time

Job summary

FyerX Global Private Limited seeks an experienced Application Security / DevSecOps Engineer to embed safety controls into automated software delivery. You will bridge software development with security operations, implementing testing gates, leading threat modeling, and hardening containers before production.

The role focuses on securing CI/CD pipelines, managing security tooling, and coordinating vulnerability remediation with development teams across remote environments.

Qualifications

• 4–8 years of software engineering or cloud DevOps experience.
• 3+ years dedicated to SDLC security and DevSecOps pipelines.
• Strong mastery of automated testing engines and container security.
• Working knowledge of OWASP Top 10, API security, and secure coding standards.
• Mandatory certifications: CASE, CDP, CSSLP, or CEH.

Responsibilities

• Design and integrate automated security testing gates into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins).
• Configure and manage SAST/DAST/SCA tooling and security scanners.
• Triage and remediate vulnerabilities with development teams.
• Lead threat modeling sessions for new apps and features.
• Govern security infrastructure with dashboards and secret vaults.
• Secure container workloads by auditing Dockerfile rules and Kubernetes isolation.
• Lead incident investigations into web payloads and API tampering.

Tools

Snyk

Checkmarx

Veracode

OWASP ZAP

GitHub Actions

GitLab CI

Jenkins

Docker

Kubernetes

DefectDojo

SonarQube

HashiCorp Vault

AWS Secrets Manager

Job description

This is a remote position.

Application Security (AppSec) / DevSecOps Engineer

Job Details

• Employment Type: Contract


• Work Mode: Remote


• Location: Offshore


• Total Experience Required: 4 to 8 years


• Relevant Experience Required: 3+ years of dedicated experience securing software development lifecycles (SDLC) and engineering DevSecOps pipelines


• Mandatory Certification: Certified Application Security Engineer (CASE), Certified DevSecOps Professional (CDP), CSSLP, or CEH

Job Summary

We are seeking an experienced Application Security / DevSecOps Engineer to bake robust safety controls directly into our automated software delivery frameworks. The ideal candidate will bridge software engineering with security operations, implementing automated code testing gates, leading threat modeling workshops, and hardening application containers to identify and mitigate software vulnerabilities before code hits production.

Key Responsibilities

• Design and integrate automated security testing gates directly into modern CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Jenkins).


• Configure and manage application scanning frameworks, orchestrating Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tooling.


• Triage and remediate software vulnerabilities, analyzing code flaws, open-source dependency risks, and secret exposure incidents alongside software development teams.


• Lead comprehensive threat modeling assessments for new applications and architecture features, identifying attack surfaces and defining secure coding frameworks.


• Govern application security infrastructure, managing centralized vulnerability aggregation dashboards (e.g., DefectDojo, SonarQube) and secret vaults (e.g., HashiCorp Vault, AWS Secrets Manager).


• Secure containerized application workloads, auditing Dockerfile construction rules, verifying baseline machine images, and checking Kubernetes network isolation parameters.


• Drive application layer incident investigations, analyzing malicious payload web requests, API tampering logs, and cross-site scripting (XSS) vectors to improve software perimeters.

Requirements

• 4 to 8 years of core software engineering or cloud DevOps experience, with 3+ dedicated years actively designing, building, and deploying application safety frameworks.


• Strong technical mastery of automated testing engines (e.g., Snyk, Checkmarx, Veracode, OWASP ZAP), container security paradigms, and infrastructure-as-code hardening.


• Deep structural understanding of the OWASP Top 10 vulnerabilities, API security perimeters, modern secure coding standards, and cryptographic signing protocols.


• Mandatory certification: CASE, CDP, CSSLP, or CEH.

Preferred Qualifications

• Prior experience with software development in languages like Java, Python, JavaScript/Node.js, or Go.


• Experience implementing automated code patching routines or managing runtime application self-protection (RASP) layers.