Senior DevSecOps Engineer & Security Lead

MindMerge Consulting; Petaling Jaya; On-site; MYR 180,000 - 240,000; Full time

Job summary

MindMerge Consulting seeks a Senior Executive, DevSecOps Engineering to own and embed security controls across the full SDLC in a 24x7 AWS-based environment. You will drive threat modelling, secure coding guardrails, automated testing, and risk-based gates across engineering, cloud, and operations teams.

You will implement software-supply-chain protections, SBOM provenance, and auditable release governance while mentoring teams on remediation and secure-by-design practices.

Qualifications

• Hands-on secure SDLC practices and threat modelling experience.
• Experience with SAST/DAST/SCA, secrets scanning, and IaC scanning in CI/CD.
• Knowledge of AWS security services, IAM, encryption, logging, and cloud posture.
• Experience with Terraform, Ansible, CloudFormation, Docker, and serverless stacks.
• Ability to translate regulatory requirements into engineering controls.
• Experience triaging vulnerabilities and coordinating remediation.
• Familiarity with BNM RMiT, ISO/IEC 27001, NIST CSF, CIS Benchmarks, OWASP guidance.
• Proficiency in code collaboration tools and protected branches.
• 3+ years in DevSecOps or secure CI/CD delivery across hybrid environments.
• Proven ability to communicate security findings clearly and drive remediation.

Responsibilities

• Security Requirements & Threat Modelling across planning and architecture.
• Establish secure coding standards and guardrails aligned with OWASP.
• Integrate SAST, DAST, SCA, secrets scanning, and IaC scanning into CI/CD.
• Implement risk-based pipeline gates and exception handling with approvals.
• Secure software supply chain including SBOMs and trusted repositories.
• Triage findings, assess business impact, and track remediation SLAs.
• Apply secure baselines and policy-as-code to AWS, Terraform, Ansible, Docker.
• Prevent credentials in code/pipelines; manage rotation and short-lived credentials.
• Maintain traceable approvals, immutable artifacts, and release governance.
• Enhance runtime security, logging, alerting, and incident playbooks.
• Translate standards into automated controls and audit evidence; monitor coverage.

Skills

Secure SDLC

Threat modelling

OWASP practices

SAST

DAST

SCA

CI/CD workflows

AWS security

Terraform

Docker

GitHub / GitLab

Python / Bash / PowerShell

Education

Bachelor’s degree in CS or related

Tools

GitLab

Bitbucket

GitHub

Terraform

CloudFormation

Ansible

Job description

MindMerge Consulting seeks a Senior Executive, DevSecOps Engineering to own and embed security controls across the full SDLC in a 24x7 AWS-based environment. You will drive threat modelling, secure coding guardrails, automated testing, and risk-based gates across engineering, cloud, and operations teams.

You will implement software-supply-chain protections, SBOM provenance, and auditable release governance while mentoring teams on remediation and secure-by-design practices.