DevSecOps Engineer

Cloud Kinetics; Selangor; On-site; MYR 120,000 - 160,000; Full time

Job summary

Cloud Kinetics is seeking a Senior Executive, DevSecOps Engineering to own security controls across the SDLC, embedding secure-by-default CI/CD pipelines and automated gates. You will collaborate with engineering, cloud, infrastructure, cybersecurity, risk, and compliance teams to reduce risk in hybrid AWS environments.

The role emphasizes threat modelling, secure coding, automated testing (SAST/DAST/SCA), and SBOM provenance, with emphasis on least privilege, auditability, and traceability in

Qualifications

• 3+ years in DevSecOps or secure CI/CD across hybrid environments.
• Experience embedding automated security testing into build, test, release, and deployment pipelines.
• Experience securing AWS services, identities, networks, containers, serverless workloads, and infrastructure-as-code.
• Experience triaging vulnerabilities, coordinating remediation, and producing evidence for security reviews and audits.
• Collaboration across engineering, security, risk, compliance, and operations teams to promote security-by-design.

Responsibilities

• Define security and privacy requirements during planning and architecture; facilitate threat modelling and risk reviews.
• Establish secure coding standards, reusable pipeline templates, and branch protections aligned with OWASP.
• Integrate SAST, DAST, SCA, secrets detection, API security testing, and container scanning into pipelines.
• Implement risk-based pipeline gates with approval workflows for exceptions.
• Secure source, runners, build systems, dependencies, artifacts, registries, and deployment workflows.
• Triage findings, remove false positives, track remediation SLAs, verify fixes, and report exposure.
• Apply secure baselines and policy-as-code to AWS, Terraform, Ansible, CloudFormation, Docker, and serverless services.
• Prevent credentials in code/pipelines; manage secrets and short-lived credentials.
• Maintain traceable approvals, immutable artifacts, controlled environment promotion, and release evidence.

Skills

DevSecOps

App security

Cloud security

Python

CI/CD automation

Threat modelling

OWASP practices

Tools

AWS

Terraform

Ansible

CloudFormation

Docker

Job description

The Senior Executive, DevSecOps Engineering will own and embed security controls across the end-to-end software development lifecycle (SDLC)—requirements, architecture, coding, build, test, release, deployment, and operations. The role will engineer secure-by-default CI/CD pipelines, automate risk-based security gates, and provide developers with timely, actionable feedback so vulnerabilities are prevented or remediated before production. Working across engineering, cloud, infrastructure, cybersecurity, risk, and compliance teams, the incumbent will reduce application, platform, and software supply-chain risk across hybrid environments, primarily AWS.

KEY RESPONSIBILITIES

• Security Requirements & Threat Modelling: Define security and privacy requirements during planning and architecture; facilitate threat modelling, abuse-case analysis, and risk reviews before implementation.
• Secure Coding & Developer Guardrails: Establish secure coding standards, reusable pipeline templates, approved components, branch protections, peer-review controls, pre-commit checks, and developer guidance aligned with OWASP practices.
• Automated Application Security Testing: Integrate and tune SAST, DAST, SCA, secrets detection, API security testing, container scanning, and infrastructure-as-code scanning to provide fast, actionable feedback.
• Risk-Based Pipeline Gates: Implement severity, exploitability, asset-criticality, and compliance-based thresholds that block unacceptable risk while allowing documented, time-bound exceptions with accountable approval.
• Software Supply-Chain Security: Secure source, runners, build systems, dependencies, artifacts, registries, and deployment workflows using least privilege, isolated builds, SBOMs, provenance, signing, integrity verification, and trusted repositories.
• Vulnerability Remediation & Assurance: Triage findings, remove false positives, assess business impact, assign owners, track remediation service levels, verify fixes, manage risk acceptance, and report overdue exposure.
• Cloud, Container & IaC Security: Apply secure baselines and policy-as-code to AWS, Terraform, Ansible, CloudFormation, Docker, serverless services, IAM, networks, encryption, data services, and cloud configurations.
• Secrets, Identity & Access: Prevent credentials in code and pipelines; implement managed secrets, rotation, workload identity, short-lived credentials, role-based access, privileged access controls, and segregation of duties.
• Secure Release & Deployment: Maintain traceable approvals, immutable artifacts, controlled environment promotion, deployment verification, rollback readiness, and release evidence for production changes.
• Runtime Security & Feedback Loops: Improve security logging, detection, alerting, workload monitoring, incident playbooks, and forensic readiness; feed production findings, incidents, and penetration-test results back into backlog and pipeline controls.
• Governance, Metrics & Enablement: Translate internal standards and applicable requirements, including BNM RMiT, into automated controls and audit evidence; track control coverage, mean time to remediate, defect escape rate, exception ageing, and recurring root causes while coaching engineering teams.

Work Experience

• 3+ years of hands-on experience in DevSecOps, application security, cloud security, platform engineering, or secure CI/CD delivery across hybrid environments.
• Demonstrated experience embedding automated security testing and policy checks into build, test, release, and deployment pipelines without creating unnecessary delivery friction.
• Practical experience securing AWS services, identities, networks, containers, serverless workloads, and infrastructure-as-code.
• Experience triaging vulnerabilities, coordinating remediation, managing risk exceptions, and producing evidence for security reviews and audits.
• Exposure to security monitoring, SIEM integration, incident response, detection engineering, and observability within 24x7 operational environments.
• Proven ability to collaborate with developers, security, risk, compliance, infrastructure, and operations teams and to communicate security findings with clear, actionable remediation guidance.
• DevSecOps Automation: Proficiency in Python, Bash, or PowerShell and in automating repeatable security controls and evidence collection.
• Application & Pipeline Security: Strong capability in SAST, DAST, SCA, secrets detection, API testing, security gates, and secure build and release design.
• Cloud-Native Security: Working knowledge of cloud, IAM, containers, serverless, infrastructure-as-code, encryption, and policy-as-code security.
• Risk, Compliance & Governance: Ability to convert regulatory and security requirements into proportionate, traceable, and measurable engineering controls.
• Collaboration & Security Enablement: Skilled in partnering with engineering teams, explaining risk in practical terms, documenting standards, and promoting a security-by-design culture.