Senior DevSecOps / Platform Security Engineer

Space Inventive; Hyderabad; On-site; INR 350,000 - 550,000; Full time

Job summary

Space Inventive is seeking a hands-on Security Engineer to build a secure paved road for GenAI applications across product streams. You will ensure security is embedded in delivery, author reusable templates, and drive secure practices with project teams.

You will run advanced security tools, model threats with teams, and enhance CI/CD security while remediating findings. Experience with AWS security, IaC, and SAST/SCA is highly valued.

Qualifications

• Senior-level engineering maturity with ownership of security outcomes.
• Strong software engineering ability; hands-on Python coding and code review.
• Hands-on CI/CD engineering, ideally Jenkins pipelines and shared libraries.
• Container security practices: multi-stage, digest-pinned, non-root images.
• Dependency & supply-chain know-how: lockfiles, hash pinning, safe index resolution.
• AWS security engineering: least-privilege IAM, secrets management.
• Secret management and secret scanning including pre-commit gating.
• Experience integrating SAST/SCA/IaC scanning into pipelines with gates.
• Comfort using AI coding agents to accelerate delivery with oversight.

Responsibilities

• Run advanced security tools and manage results.
• Threat model the application with the team.
• Improve CI/CD security.
• Remediate security findings.
• Raise the bar for software supply chain security.
• Package templates and guidance to spread secure practices across repositories.

Skills

Python coding

CI/CD security

Threat modeling

Container security

SAST/SCA integration

AWS security

Secret management

Code review

Tools

Jenkins

Docker

Bitbucket

Helm

AI coding agents

Job description

We are hiring a hands-on Security Engineer, a DevSecOps / Platform Security Engineer to build the shared "secure paved road" for a portfolio of GenAI applications delivered across several product streams. Your job is to make the secure way the default way: run security tools and remediate for and with the project team findings in IaC, back- and front-ends, build reusable pipeline, container, and dependency-management templates that every stream inherits, so security is built in at delivery time rather than bolted on afterward.

What you'll do

• Run advanced security tools and manage the results.
• Threat models the application with the team.
• Improve on CI/CD security.
• Remediate security findings.
• Bar-raise software supply chain security.
• Package everything as reusable templates plus short "how and why" guidance so the paved road spreads without you in the loop for every repository.

What you'll bring (required)

• Senior-level engineering maturity — sets standards, drives adoption across teams, and owns security outcomes end-to-end together with the team and higher level security leadership.
• Strong, current software engineering / coding ability — you write and review Python code, not only edit configuration. A portfolio, repository, or code sample you can walk us through.
• Hands-on CI/CD engineering, ideally Jenkins (pipelines and shared libraries).
• Container security in practice: multi-stage, digest-pinned, non-root Docker images; understanding of image attack surface.
• Python and/or Node dependency & supply-chain know-how: lockfiles, hash pinning, safe index resolution, dependency scanning.
• AWS security engineering: least-privilege IAM, secrets management, and hardening of container/serverless workloads.
• Practical secret management and secret scanning, including pre-commit gating.
• Experience integrating SAST / SCA / IaC scanning into pipelines as enforced gates, with sensible false-positive tuning.
• Comfort using AI coding agents (e.g. Kiro, Claude Code, Codex) as a daily tool to ship faster — with the judgment to review and verify their output.

Strongly preferred — Security Credentials

• AWS Security Specialty certification (AWS Certified Security – Specialty) is highly desirable.
• Alternatively, other strong industry security credentials — e.g. OSCP, CISSP, or equivalent deep technical security or security management credentials.

Nice to have

• Experience in a regulated environment (HCLS / pharma / GxP / HIPAA / GDPR).
• GenAI / LLM application exposure: managed model endpoints (e.g. Amazon Bedrock), retrieval-augmented generation, and the security considerations that come with them.
• Application-security depth (authN/authZ, tenant isolation, common web vulnerabilities).
• Familiarity with Bitbucket, an artifact registry, and Helm.