Lead DevSecOps Engineer

Epam Systems; Bengaluru; Hybrid; INR 600,000 - 900,000; Full time

Benefits offered by this job

Hybrid work

Office days Bengaluru

Job summary

Epam Systems in Bengaluru seeks an experienced Lead DevSecOps Engineer to drive security into our development and deployment pipelines. This role requires 3 days in the office and supports a hybrid work model.

You will design secure CI/CD workflows, lead vulnerability management initiatives, and champion a security-first culture across engineering teams, while mentoring engineers on secure coding and automation practices.

Qualifications

• 7–14 years of experience in DevSecOps and product cybersecurity environments.
• Hands-on experience with SBOM frameworks and toolchains.
• Knowledge of software supply chain security and vulnerability management.

Responsibilities

• Lead design and implementation of DevSecOps across pipelines.
• Integrate SAST and DAST into CI/CD toolchains for continuous security validation.
• Develop and maintain SBOM frameworks for transparency and compliance.
• Drive software supply chain security initiatives across the delivery lifecycle.
• Build security integrations, pipeline automation, and tooling for secure CI/CD workflows.
• Operate vulnerability scanning tools to identify, triage, and remediate risks.
• Apply security frameworks to guide threat modeling and risk mitigation.
• Collaborate with cross-functional teams to embed security best practices.
• Mentor engineers on secure coding, automation, and modern DevSecOps methodologies.

Skills

DevSecOps

Automation scripting

Python

Bash

CI/CD integration

Vulnerability scanning

SBOM frameworks

AWS

Threat modeling

Security frameworks

Tools

Black Duck

Trivy

SonarQube

Nexus

Job description

We are seeking an experienced Lead DevSecOps Engineer to drive the integration of security practices into our development and deployment pipelines. In this role, you will design and implement secure CI/CD workflows, lead vulnerability management initiatives, and champion a security-first culture across engineering teams.

Please note that this role requires 3 days of work in the office.

Responsibilities

• Lead the design and implementation of DevSecOps practices across development and deployment pipelines
• Integrate SAST and DAST tools into the CI/CD toolchain to ensure continuous security validation
• Develop and maintain SBOM frameworks to support software transparency and compliance
• Drive software supply chain security initiatives to safeguard the end-to-end delivery lifecycle
• Build security integrations, pipeline automation, and tooling for secure CI/CD workflows using scripting languages
• Operate and optimize vulnerability scanning tools to identify, triage, and remediate security risks
• Apply industry-recognized security frameworks to guide threat modeling and risk mitigation
• Collaborate with cross-functional teams to embed security best practices into product development
• Mentor engineers on secure coding, automation, and modern DevSecOps methodologies

Requirements

• 7-14 years of experience working in DevSecOps and product cybersecurity environments
• Knowledge of SBOM frameworks and associated toolchains
• Background in software supply chain security
• Hands-on expertise in vulnerability scanning tools
• Proficiency in integrating SAST and DAST into CI/CD toolchains
• Strong scripting and automation skills using Python, Bash, or similar languages for security integrations and pipeline automation
• Hands-on experience with tools such as Black Duck, Trivy, and SonarQube, or Nexus and similar solutions
• Familiarity with security frameworks such as OWASP Top 10 and MITRE ATT&CK or similar
• Competency in AWS
• English proficiency at an Upper-Intermediate level (B2) or higher

Nice to have

• Experience working in regulated industries such as automotive, industrial, or IoT
• Skills in container security and Kubernetes environments
• Familiarity with security monitoring and logging tools such as SIEM or centralized logging platforms