DevOps Engineer/DevSecOps

Cerebra; Chennai District; On-site; INR 2,500,000 - 4,500,000; Full time

Job summary

Cerebra is seeking a DevSecOps professional to design and operate secure CI/CD pipelines across enterprise platforms in Chennai. You will embed SAST/DAST/SCA in workflows, enforce policy gates, and manage secrets as part of a secure software delivery lifecycle.

You will work with container security tooling, image scanning, and IaC automation using Terraform/Ansible, with scripting in Python/Bash/Go to automate repetitive tasks and controls.

Qualifications

• Secure CI/CD pipeline engineering across major platforms (GitHub Actions, GitLab CI, Azure DevOps, Jenkins, Harness).
• Automated security testing in pipelines: SAST, DAST, and SCA with leading tools.
• Policy as Code and automated release gates using OPA, Rego, Checkov, tfsec, Terrascan or Kyverno.

Skills

CI/CD engineering

App security testing

Policy as Code

Secrets management

Container security

Scripting

Tools

GitHub Actions

GitLab CI

Azure DevOps

Jenkins

Harness

SonarQube

Checkmarx

Snyk

Veracode

ZAP

Burp Suite

AWS Secrets Manager

HashiCorp Vault

Cosign

Sigstore

Terraform

Ansible

Kubernetes

Trivy

Grype

OPA

Job description

Role: DevOps Engineer/DevSecOps

Experience: 7+ Years

Notice period: Immediate to 15 days

Location: Chennai

Skills: DevOps Engineer (DevSecOps / Secure Software Delivery)

Secure CI/CD Pipelines, SAST & DAST Tooling, Dependency & Software Composition Analysis (SCA), Secrets Detection, Policy as Code & Automated Quality Gates (OPA / Rego / Checkov), Secure Software Delivery Lifecycle (SSDLC), Container & Cloud Security, Python / Bash / Scripting, Infrastructure as Code (Terraform)

Desired Experience Range : 7 to 12 Years (with strong focus on CI/CD engineering, pipeline security controls, automated testing gates, and Policy as Code)

Role Descriptions:

Must-Have

Must-Have (Candidates must demonstrate depth in core DevOps engineering and a blend/combination of the following specialisms)

• Secure CI/CD Pipeline Engineering: Extensive hands-on experience designing, automating, and maintaining resilient CI/CD pipelines across enterprise platforms (GitHub Actions, GitLab CI, Azure DevOps, Jenkins, Harness).
• Application Security Testing (SAST / DAST / SCA): Practical experience embedding and operationalising automated security scanners natively into pipeline workflows: Static Application Security Testing (SonarQube, Checkmarx, Snyk Code, Veracode), Dynamic Application Security Testing (ZAP, Burp Suite, Rapid7, StackHawk), and Software Composition Analysis / Dependency Scanning (Snyk Open Source, Black Duck, Dependabot, Nexus Lifecycle).
• Policy as Code & Automated Quality Gates: Proven track record authoring and enforcing declarative compliance policies and release gates using Open Policy Agent (OPA), Rego, Checkov, tfsec, Terrascan, or Kyverno to block non-compliant code before deployment.
• Secrets Detection & Management: Experience implementing automated pre-commit and pipeline secrets detection (GitGuardian, TruffleHog, Gitleaks) and integrating enterprise secrets management systems (HashiCorp Vault, Azure Key Vault, AWS Secrets Manager, GCP Secret Manager).
• Secure Software Delivery & Container Security: Deep understanding of container image scanning, vulnerability triage, runtime security baselines, and artifact signing (Trivy, Grype, Prisma Cloud, Cosign / Sigstore).
• Scripting & Infrastructure as Code: Strong proficiency in Python, Bash, or Go for automation scripting, coupled with hands-on Terraform / Ansible experience for reproducible infrastructure provisioning.

Good-to-Have

• Understanding of enterprise Secure Software Development Lifecycle (SSDLC) operating models, specifically Inner Loop (developer workstation/IDE feedback) vs. Outer Loop (governed platform gates and continuous compliance) paradigms.
• Knowledge of Software Bill of Materials (SBOM) generation, supply chain integrity frameworks (SLSA, NIST SSDF), and artifact provenance tracking.
• Exposure to multi-cloud landing zones and Kubernetes orchestration (GKE, AKS, EKS).
• Certifications: Certified DevSecOps Professional (CDP), GitHub Actions / Azure DevOps Certified, HashiCorp Certified Terraform Associate, or AWS/Azure/GCP Security Specialty.