Senior DevSecOps Engineer - Secure CI/CD & Cloud Security

Cloud Kinetics; Selangor; On-site; MYR 180,000 - 350,000; Full time

Job summary

Cloud Kinetics is seeking a Senior Executive, DevSecOps Engineering to own security controls across the SDLC in hybrid environments, primarily AWS, interfacing with engineering, cloud, and risk teams.

You will implement secure-by-default CI/CD pipelines, threat modelling, and automated gates, ensuring vulnerabilities are prevented or remediated before production. Strong collaboration and hands-on AWS, IaC, and container security are required.

Qualifications

• 3+ years in DevSecOps, security across SDLC.
• Experience embedding automated security testing into pipelines.
• Hands-on with AWS, IaC, containers and serverless.
• Ability to collaborate across security, risk, compliance teams.

Responsibilities

• Security Requirements & Threat Modelling: Define security requirements during planning and architecture; facilitate threat modelling, abuse-case analysis, and risk reviews before implementation.
• Secure Coding & Developer Guardrails: Establish secure coding standards, reusable pipeline templates, approved components, branch protections, peer-review controls, pre-commit checks, and developer guidance aligned with OWASP practices.
• Automated Application Security Testing: Integrate and tune SAST, DAST, SCA, secrets detection, API security testing, container scanning, and infrastructure-as-code scanning to provide fast, actionable feedback.
• Risk-Based Pipeline Gates: Implement severity, exploitability, asset-criticality, and compliance-based thresholds that block unacceptable risk while allowing documented, time-bound exceptions with accountable approval.
• Software Supply-Chain Security: Secure source, runners, build systems, dependencies, artifacts, registries, and deployment workflows using least privilege, isolated builds, SBOMs, provenance, signing, integrity verification, and trusted repositories.
• Vulnerability Remediation & Assurance: Triage findings, remove false positives, assess business impact, assign owners, track remediation service levels, verify fixes, manage risk acceptance, and report overdue exposure.
• Cloud, Container & IaC Security: Apply secure baselines and policy-as-code to AWS, Terraform, Ansible, CloudFormation, Docker, serverless services, IAM, networks, encryption, data services, and cloud configurations.
• Secrets, Identity & Access: Prevent credentials in code and pipelines; implement managed secrets, rotation, workload identity, short-lived credentials, role-based access, privileged access controls, and segregation of duties.
• Secure Release & Deployment: Maintain traceable approvals, immutable artifacts, controlled environment promotion, deployment verification, rollback readiness, and release evidence for production changes.
• Runtime Security & Feedback Loops: Improve security logging, detection, alerting, workload monitoring, incident playbooks, and forensic readiness; feed production findings, incidents, and penetration-test results back into backlog and pipeline controls.
• Governance, Metrics & Enablement: Translate internal standards and applicable requirements, including BNM RMiT, into automated controls and audit evidence; track control coverage, mean time to remediate, defect escape rate, exception ageing, and recurring root causes while coaching engineering teams.

Skills

DevSecOps Automation

App & Pipeline Security

Cloud-Native Security

Risk & Governance

Security Enablement

Job description

Cloud Kinetics is seeking a Senior Executive, DevSecOps Engineering to own security controls across the SDLC in hybrid environments, primarily AWS, interfacing with engineering, cloud, and risk teams.

You will implement secure-by-default CI/CD pipelines, threat modelling, and automated gates, ensuring vulnerabilities are prevented or remediated before production. Strong collaboration and hands-on AWS, IaC, and container security are required.