DevSecOps & Cloud Security Consultant

Robotico Digital®; Muscat; On-site; OMR 27,000 - 38,000; Full time

Job summary

Robotico Digital® is looking for a DevSecOps & Cloud Security Consultant to join our Muscat on-site team for a 1-year assignment. You will lead security reviews across CI/CD, IaC, Helm charts, and cloud configurations, driving automated security controls and vulnerability management within DevSecOps workflows.

The role requires strong experience in cloud-native security, Kubernetes, and SAST, with collaboration across security, development, and operations to improve the organization's security

Qualifications

• The following skills are explicitly identified in the RFP's Resource 2 profile: DevSecOps security, CI/CD security, Infrastructure as Code (IaC), Helm chart security, Source code review (SAST), Cloud security, Kubernetes security, Vulnerability management, Security automation, Policy enforcement, Security tool evaluation.

Responsibilities

• Assess and strengthen security across CI/CD pipelines and DevSecOps workflows.
• Review IaC templates for insecure configurations and misconfigurations.
• Conduct security reviews of Kubernetes Helm charts.
• Perform SAST to identify insecure coding practices.
• Assess cloud security configurations, IAM, network controls, and logging.
• Review Kubernetes security controls and container deployment configurations.
• Implement or validate security automation and policy enforcement with OPA/Gatekeeper.
• Support vulnerability management, risk assessment and remediation tracking.
• Evaluate security tools, conduct POCs and document findings.
• Prepare assessment findings, risk ratings and remediation recommendations.
• Coordinate with development, infrastructure and InfoSec teams.

Skills

DevSecOps security

CI/CD security

Infrastructure as Code

Helm chart security

Source code review

Cloud security

Kubernetes security

Vulnerability management

Security automation

Policy enforcement

Security tool evaluation

Job description

Position: DevSecOps & Cloud Security Consultant

5–7+ years’ experience

Full-time onsite

Initial 1 year

Location: Muscat

1. Job description (JD)

The DevSecOps & Cloud Security Consultant will perform security assessments of DevSecOps pipelines, cloud infrastructure, Kubernetes environments and application delivery processes. The consultant will review CI/CD security, Infrastructure as Code (IaC), Helm charts, source code, cloud configurations and security policies; identify vulnerabilities and misconfigurations; automate security controls; and support security tool evaluation and implementation.

Key responsibilities

• Assess and strengthen security across CI/CD pipelines and DevSecOps workflows.
• Review Infrastructure as Code (IaC) templates for insecure configurations, excessive permissions, hardcoded credentials and exposed secrets.
• Conduct manual and automated security reviews of Kubernetes Helm charts.
• Perform source code security reviews using Static Application Security Testing (SAST).
• Assess cloud security configurations, identity and access management (IAM), network controls, encryption and logging.
• Review Kubernetes security controls and container deployment configurations.
• Implement or validate security automation and policy enforcement using OPA/Gatekeeper.
• Support vulnerability management, risk assessment, remediation tracking and revalidation.
• Evaluate security tools and conduct POCs across cloud, application, container, API and DevSecOps security.
• Prepare assessment findings, risk ratings, remediation recommendations and technical reports.
• Coordinate with development, infrastructure, cloud and Information Security teams.

2. Mandatory technical skills

The following skills are explicitly identified in the RFP's Resource 2 profile.

Skill area

Required expertise

DevSecOps security

Security integration throughout software development and deployment workflows

CI/CD security

Pipeline security reviews, automated testing integration and secure delivery processes

Infrastructure as Code (IaC)

Reviewing infrastructure templates for security risks and misconfigurations

Helm chart security

Reviewing deployment charts, Kubernetes security settings and secure deployment practices

Source code review (SAST)

Static analysis and identification of insecure coding practices and vulnerabilities

Cloud security

Cloud configuration reviews, IAM controls, network security, encryption and logging

Kubernetes security

Kubernetes environments, access controls, workloads, configurations and security baselines

Vulnerability management

Vulnerability identification, validation, prioritisation, remediation tracking and retesting

Security automation

Automating security checks and integrating security controls into delivery workflows

Policy enforcement

OPA/Gatekeeper policy validation, compliance enforcement and deployment controls

Security tool evaluation

Assessing security tools, conducting POCs and documenting findings and recommendations

3. Experience requirements

• Overall experience: 5–7+ years in DevSecOps and cloud security.
• Hands-on experience securing CI/CD pipelines and software delivery workflows.
• Experience reviewing IaC templates, Helm charts and source code.
• Experience with cloud security configurations and Kubernetes environments.
• Practical knowledge of vulnerability management and security automation.
• Experience implementing or validating policy enforcement using OPA/Gatekeeper.
• Experience evaluating security tools and supporting POC activities.

4. Qualifications and certifications

Graduate with below certifications will be preferred.

• CEH — Certified Ethical Hacker
• CISSP — Certified Information Systems Security Professional
• OSCP — Offensive Security Certified Professional
• CISA — Certified Information Systems Auditor
• CISM — Certified Information Security Manager