DevOps Engineer

ServCrust Pvt. Ltd.; Hyderabad; Sur place; INR 900 000 - 1 300 000; Plein temps

Résumé du poste

ServCrust Pvt. Ltd. is seeking a technically strong DevSecOps Engineer to embed, automate, and enforce security across our CI/CD pipelines and cloud-native environments.

The role bridges engineering and security teams to integrate guardrails, secure coding, and best practices across the SDLC. You will monitor pipelines daily, triage vulnerabilities, and support development teams with secure delivery practices, contributing to threat modelling and architecture reviews.

Qualifications

• 2–4 years of experience in DevSecOps, AppSec, or Security Engineering.
• Strong understanding of CI/CD workflows and security integration.
• Hands-on scripting/automation experience (Python, Bash, Groovy, YAML pipelines).
• Familiarity with cloud-native deployments and vulnerability management.
• Knowledge of OWASP Top 10, SANS CWE 25, container security benchmarks.

Responsabilités

• Monitor CI/CD pipelines for policy violations, secret leakage, insecure configs, and bypass attempts.
• Review SAST/DAST/IAST scan results and work with developers to prioritize fixes.
• Analyze container security reports and recommend hardening updates.
• Perform IaC security reviews for Terraform and CloudFormation templates.
• Maintain and enforce pipeline security guardrails (code signing, static analysis, approvals).
• Collaborate with dev and platform teams on secure coding and deployments.
• Document pipeline security procedures, runbooks, and guidance.
• Evaluate new security tools, run POCs, and integrate solutions.

Connaissances

CI/CD workflows

Python scripting

Security engineering

Threat modeling

Cloud security

Outils

SonarQube

Checkmarx

OWASP ZAP

Dependency checks

Description du poste

We’re looking for a technically strong and security-focused DevSecOps Engineer to embed, automate, and operationalize security across our CI/CD pipelines and cloud-native environments. You will act as the bridge between engineering and security teams ensuring that security controls, guardrails, and best practices are integrated throughout the SDLC. This role is hands‑on, involving daily monitoring, pipeline security enforcement, vulnerability triage, and supporting development teams with secure delivery practices.

Key Responsibilities:

Secure DevOps Operation:

• Monitor CI/CD pipelines for policy violations, secret leakage, insecure configs, and bypass attempts.
• Review SAST/DAST/IAST scan results (SonarQube, Checkmarx, ZAP, OWASP Dependency-Check) and work with developers to prioritize fixes.
• Analyze container security reports and recommend base-image hardening updates.
• Perform IaC security reviews for Terraform and CloudFormation templates.
• Maintain and enforce pipeline security guardrails (code signing, mandatory static analysis, approval stages).
• Monitor cloud and pipeline security dashboards for abnormal behavior.
• Respond to real-time security findings in CI/CD and cloud workloads.

Security Automation and Collaboration:

• Implement automated security checks, quality gates, and policy-as-code controls within CI/CD.
• Maintain a JIRA vulnerability board and track remediation SLAs.
• Write automation scripts (Python, Bash, Groovy) to reduce manual security tasks.
• Collaborate with dev and platform teams on secure coding, dependency hygiene, and secure deployments.
• Participate in threat modelling, architecture reviews, and secure design discussions.
• Document pipeline security procedures, runbooks, and developer guidance.
• Evaluate new security tools, run POCs, and integrate selected solutions.

Qualifications

• 2-4 years of experience in DevSecOps, AppSec, or Security Engineering.
• Strong understanding of CI/CD workflows and security integration.
• Hands‑on scripting/automation experience (Python, Bash, Groovy, YAML pipelines).
• Familiarity with cloud-native deployments and vulnerability management.
• Knowledge of secure coding practices and SDLC best practices.
• Understanding of OWASP Top 10, SANS CWE 25, container security benchmarks.