Devsecops Engineer

ThoughtFocus; Hyderabad; Hybrid; INR 1,500,000 - 2,500,000; Full time

Job summary

ThoughtFocus is hiring a DevSecOps & Application Security Engineer to embed security across our cloud infrastructure, applications, and CI/CD pipelines. You will integrate security controls into the SDLC/CI/CD processes and build secure Terraform-based infrastructure while enforcing security across AWS and Azure.

You will perform SAST/DAST, secret management, secure code reviews, and remediation with engineering teams, and contribute to SBOM and software supply chain security practices.

Qualifications

• 7 to 10 years in DevSecOps, Application Security or Cloud Security.
• Hands-on Terraform and IaC implementation experience.
• Experience with SAST/DAST and CI/CD security integration.
• AWS or Azure security experience.
• Experience with security tooling (Veracode, GHAS, Checkmarx, Fortify, Snyk).
• Secure code review and vulnerability management.

Responsibilities

• Integrate security controls and scanning into the SDLC and CI/CD pipelines.
• Build and maintain secure Infrastructure as Code with Terraform.
• Implement security controls across AWS and Azure.
• Manage SAST, DAST, dependency and secret scanning; triage and tune findings.
• Conduct secure code reviews and drive remediation with engineering teams.
• Work with PAM, PKI, certificates and secrets management.
• Support SBOM and software supply chain security practices.

Skills

DevSecOps experience

Terraform / IaC

SAST/DAST

Cloud security (AWS/Azure)

Secure code review

Vulnerability management

Tools

Veracode

GitHub Advanced Security

Checkmarx

Fortify

Snyk

Job description

We're hiring a DevSecOps & Application Security Engineer to embed security across our cloud infrastructure, applications, and CI/CD pipelines.

What you'll do

• Integrate security controls and scanning into the SDLC and CI/CD pipelines
• Build and maintain secure Infrastructure as Code with Terraform
• Implement security controls across AWS and Azure
• Manage SAST, DAST, dependency and secret scanning; triage and tune findings
• Conduct secure code reviews and drive remediation with engineering teams
• Work with PAM, PKI, certificates and secrets management
• Support SBOM and software supply chain security practices

What you need

• 7 to 10 years in DevSecOps, Application Security or Cloud Security
• Strong hands-on Terraform and IaC
• Hands-on SAST/DAST and CI/CD security integration
• AWS or Azure security experience
• Veracode, GitHub Advanced Security or similar (Checkmarx, Fortify, Snyk)
• Secure code review and vulnerability management

Good to have

CyberArk PAM or Vault, PKI, SBOM, Sigstore/Cosign, Policy as Code, security certifications (AWS Security Specialty, AZ-500, CKS)