Senior Executive, DevSecOps Engineering

MindMerge Consulting; Petaling Jaya; On-site; MYR 180,000 - 240,000; Full time

Job summary

MindMerge Consulting seeks a Senior Executive, DevSecOps Engineering to own and embed security controls across the full SDLC in a 24x7 AWS-based environment. You will drive threat modelling, secure coding guardrails, automated testing, and risk-based gates across engineering, cloud, and operations teams.

You will implement software-supply-chain protections, SBOM provenance, and auditable release governance while mentoring teams on remediation and secure-by-design practices.

Qualifications

• Hands-on secure SDLC practices and threat modelling experience.
• Experience with SAST/DAST/SCA, secrets scanning, and IaC scanning in CI/CD.
• Knowledge of AWS security services, IAM, encryption, logging, and cloud posture.
• Experience with Terraform, Ansible, CloudFormation, Docker, and serverless stacks.
• Ability to translate regulatory requirements into engineering controls.
• Experience triaging vulnerabilities and coordinating remediation.
• Familiarity with BNM RMiT, ISO/IEC 27001, NIST CSF, CIS Benchmarks, OWASP guidance.
• Proficiency in code collaboration tools and protected branches.
• 3+ years in DevSecOps or secure CI/CD delivery across hybrid environments.
• Proven ability to communicate security findings clearly and drive remediation.

Responsibilities

• Security Requirements & Threat Modelling across planning and architecture.
• Establish secure coding standards and guardrails aligned with OWASP.
• Integrate SAST, DAST, SCA, secrets scanning, and IaC scanning into CI/CD.
• Implement risk-based pipeline gates and exception handling with approvals.
• Secure software supply chain including SBOMs and trusted repositories.
• Triage findings, assess business impact, and track remediation SLAs.
• Apply secure baselines and policy-as-code to AWS, Terraform, Ansible, Docker.
• Prevent credentials in code/pipelines; manage rotation and short-lived credentials.
• Maintain traceable approvals, immutable artifacts, and release governance.
• Enhance runtime security, logging, alerting, and incident playbooks.
• Translate standards into automated controls and audit evidence; monitor coverage.

Skills

Secure SDLC

Threat modelling

OWASP practices

SAST

DAST

SCA

CI/CD workflows

AWS security

Terraform

Docker

GitHub / GitLab

Python / Bash / PowerShell

Education

Bachelor’s degree in CS or related

Tools

GitLab

Bitbucket

GitHub

Terraform

CloudFormation

Ansible

Job description

Petaling Jaya, Malaysia

Our client is a well known leading IT provider in Malaysia and currently looking for a Senior Executive, DevSecOps Engineering in Department IT - Technology, Cloud & Governance. The Senior Executive, DevSecOps Engineering will own and embed security controls across the end-to-end software development lifecycle (SDLC)—requirements, architecture, coding, build, test, release, deployment, and operations. Working across engineering, cloud, infrastructure, cybersecurity, risk, and compliance teams, the incumbent will reduce application, platform, and software supply-chain risk across hybrid environments, primarily AWS.
The role will establish measurable security guardrails, secure engineering standards, vulnerability-management workflows, software supply-chain protections, and auditable release governance for a 24x7 mission-critical environment. The incumbent will lead threat-modelling activities, maintain security requirements and control evidence, support security incidents, mentor engineering teams on remediation, and continuously improve controls using findings from testing, production monitoring, incidents, and audits.

Key Responsibilities

• Security Requirements& Threat Modelling: Define security and privacy requirements duringplanning and architecture; facilitate threat modelling, abuse-case analysis,and risk reviews before implementation.
• Secure Coding & Developer Guardrails: Establish securecoding standards, reusable pipeline templates, approved components, branchprotections, peer-review controls, pre-commit checks, and developer guidancealigned with OWASP practices.
• Automated Application Security Testing: Integrate and tuneSAST, DAST, SCA, secrets detection, API security testing, container scanning,and infrastructure-as-code scanning to provide fast, actionable feedback.
• Risk-Based Pipeline Gates: Implement severity,exploitability, asset-criticality, and compliance-based thresholds that blockunacceptable risk while allowing documented, time-bound exceptions withaccountable approval.
• Software Supply-Chain Security: Secure source,runners, build systems, dependencies, artifacts, registries, and deploymentworkflows using least privilege, isolated builds, SBOMs, provenance, signing,integrity verification, and trusted repositories.
• Vulnerability Remediation & Assurance: Triage findings,remove false positives, assess business impact, assign owners, trackremediation service levels, verify fixes, manage risk acceptance, and reportoverdue exposure.
• Cloud, Container & IaC Security: Apply securebaselines and policy-as-code to AWS, Terraform, Ansible, CloudFormation,Docker, serverless services, IAM, networks, encryption, data services, andcloud configurations.
• Secrets, Identity & Access: Prevent credentialsin code and pipelines; implement managed secrets, rotation, workload identity,short-lived credentials, role-based access, privileged access controls, andsegregation of duties.
• Secure Release & Deployment: Maintain traceableapprovals, immutable artifacts, controlled environment promotion, deploymentverification, rollback readiness, and release evidence for production changes.
• Runtime Security & Feedback Loops: Improve securitylogging, detection, alerting, workload monitoring, incident playbooks, andforensic readiness; feed production findings, incidents, and penetration-testresults back into backlog and pipeline controls.
• Governance, Metrics & Enablement: Translate internalstandards and applicable requirements, including BNM RMiT, into automatedcontrols and audit evidence; track control coverage, mean time to remediate,defect escape rate, exception ageing, and recurring root causes while coachingengineering teams.

Requirements

• Bachelor’s degree inComputer Science, Cybersecurity, Information Technology, Engineering, or arelated field.
  
• Hands-on knowledge of secure SDLC practices, threat modelling, securecoding principles, and risk-based security gates.
  
• Practical experience integrating SAST, DAST, SCA, secrets scanning,container scanning, API testing, and IaC scanning into CI/CD workflows.
  
• Strong knowledge of AWS security services, IAM, SSO, encryption, keymanagement, logging, network controls, and cloud security posture management.
  
• Experience securing Terraform, Ansible, CloudFormation, Docker,serverless architectures, artifact repositories, and deployment automation.
  
• Understanding of vulnerability management, CVSS and exploitabilitycontext, dependency risk, SBOMs, software provenance, and remediationgovernance.
  
• Knowledge of security and compliance frameworks relevant to regulatedenvironments, such as BNM RMiT, ISO/IEC 27001, NIST CSF, CIS Benchmarks, andOWASP guidance.
  
• Proficiency withGitLab, Bitbucket, or GitHub, including protected branches, code reviewcontrols, runner security, pipeline orchestration, artifact governance, andauditable release approvals.
  
• 3+ years of hands-onexperience in DevSecOps, application security, cloud security, platformengineering, or secure CI/CD delivery across hybrid environments.
  
• Demonstrated experience embedding automated security testing and policychecks into build, test, release, and deployment pipelines without creatingunnecessary delivery friction.
  
• Practical experience securing AWS services, identities, networks,containers, serverless workloads, and infrastructure-as-code.
  
• Experience triaging vulnerabilities, coordinating remediation, managingrisk exceptions, and producing evidence for security reviews and audits.
  
• Exposure to security monitoring, SIEM integration, incident response,detection engineering, and observability within 24x7 operational environments.
  
• Proven ability to collaborate with developers, security, risk,compliance, infrastructure, and operations teams and to communicate securityfindings with clear, actionable remediation guidance.
  
• DevSecOps Automation : Proficiency in Python, Bash, or PowerShell and in automatingrepeatable security controls and evidence collection.
• Application & Pipeline Security : Strong capability in SAST, DAST, SCA, secrets detection, API testing,security gates, and secure build and release design.
• Cloud-Native Security : Working knowledgeof cloud, IAM, containers, serverless, infrastructure-as-code, encryption, andpolicy-as-code security.
• Risk, Compliance & Governance : Ability to convert regulatory and security requirements intoproportionate, traceable, and measurable engineering controls.
• Collaboration & Security Enablement : Skilled in partnering with engineering teams, explaining risk inpractical terms, documenting standards, and promoting a security-by-designculture.