Lead DevSecOps Engineer

EPAM Systems; India; Hybrid; INR 5,000,000 - 8,500,000; Full time

Job summary

EPAM Systems in India seeks a Lead DevSecOps Engineer to embed security into development and deployment pipelines. You will architect and deploy secure CI/CD workflows, spearhead vulnerability management, and promote a security-first mindset across engineering teams. The role requires 3 days in the office.

Essential experience includes 7–14 years in DevSecOps, SBOM frameworks, SAST/DAST, and AWS. You will mentor engineers on secure coding and automation, and collaborate across functions to

Qualifications

• 7–14 years in DevSecOps and product cybersecurity environments.
• SBOM frameworks and associated toolchains experience.
• Background in software supply chain security and vulnerability scanning.
• Proficiency embedding SAST/DAST into CI/CD toolchains.
• Scripting/automation with Python or Bash for security integrations.

Responsibilities

• Lead the design and rollout of DevSecOps practices across pipelines.
• Integrate SAST/DAST tools into the CI/CD toolchain for security validation.
• Develop SBOM frameworks to promote transparency and compliance.
• Advance software supply chain security throughout the delivery lifecycle.
• Build security integrations and tooling for secure CI/CD via scripting.
• Operate and tune vulnerability scanning tools to triage and remediate risks.
• Apply OWASP Top 10 and MITRE ATT&CK to guide threat modeling.
• Partner with cross-functional teams to embed security best practices.

Skills

DevSecOps

Security automation

CI/CD integration

SBOM frameworks

vulnerability management

Python Bash scripting

SAST/DAST tooling

AWS

Kubernetes security

English communication (B2+)

Tools

Black Duck

Trivy

SonarQube

Nexus / similar

Job description

We are looking for a skilled Lead DevSecOps Engineer to lead the embedding of security practices into our development and deployment pipelines. In this position, you will architect and deploy secure CI/CD workflows, spearhead vulnerability management efforts, and promote a security-first mindset across engineering teams. Please note that this role requires 3 days of work in the office.

Responsibilities

• Lead the design and rollout of DevSecOps practices across development and deployment pipelines
• Integrate SAST and DAST tools into the CI/CD toolchain to enable continuous security validation
• Develop and maintain SBOM frameworks to promote software transparency and compliance
• Advance software supply chain security initiatives to protect the end-to-end delivery lifecycle
• Build security integrations, pipeline automation, and tooling for secure CI/CD workflows via scripting languages
• Operate and tune vulnerability scanning tools to detect, triage, and remediate security risks
• Apply industry-recognized security frameworks to guide threat modeling and risk mitigation
• Partner with cross-functional teams to embed security best practices into product development
• Mentor engineers on secure coding, automation, and modern DevSecOps methodologies

Requirements

• 7-14 years of experience in DevSecOps and product cybersecurity environments
• Knowledge of SBOM frameworks and their associated toolchains
• Background in software supply chain security
• Expertise in vulnerability scanning tools
• Proficiency in embedding SAST and DAST into CI/CD toolchains
• Skills in scripting and automation using Python, Bash, or comparable languages for security integrations and pipeline automation
• Showcase of tools such as Black Duck, Trivy, and SonarQube, or Nexus and similar solutions
• Familiarity with security frameworks such as OWASP Top 10 and MITRE ATT&CK or equivalents
• Competency in AWS
• English proficiency at an Upper-Intermediate level (B2) or above
• Nice to have Background in regulated industries such as automotive, industrial, or IoT
• Nice to have Skills in container security and Kubernetes ecosystems
• Nice to have Familiarity with security monitoring and logging platforms such as SIEM or centralized logging solutions