Dev SecOps Engineer

Bloomberry Resorts and Hotels Inc.; Naga; On-site; PHP 900,000 - 1,400,000; Full time

Job summary

Bloomberry Resorts and Hotels Inc. is seeking a Security Engineer to integrate automated security testing into CI/CD pipelines and enforce security gates before deployment.

You will define security-as-code controls, harden containers and orchestration platforms, manage secrets, monitor vulnerabilities, and drive remediation with development teams. This role includes on-call rotations to support production systems and continuous improvement of tooling and processes.

Responsibilities

• Integrate automated security testing (SAST, DAST, SCA, container and image scanning) into CI/CD pipelines, enforcing security gates before deployment.
• Define and maintain security-as-code and policy-as-code controls, including infrastructure as code (IaC) scanning for cloud and on-premises environments.
• Harden container and orchestration platforms such as Docker and Kubernetes, enforcing least-privilege access, image signing, and runtime security controls.
• Manage secrets, credentials, and certificates through centralized secrets management, eliminating hard-coded credentials across pipelines and services.
• Monitor, triage, and prioritize vulnerabilities across code, dependencies, images, and infrastructure, driving remediation with development teams against defined SLAs.
• Automate security baseline enforcement and compliance evidence collection across cloud and on-premises environments.
• Collaborate with development teams to embed secure coding practices, threat modeling, and security requirements early in the development cycle.
• Support incident response and post-incident reviews for security events affecting pipelines, infrastructure, and workloads, driving root-cause remediation.
• Continuously improve security tooling coverage and accuracy, reducing false positives and mean time to remediate.
• Participate in the on-call rotation to support production systems.

Job description

Duties and Responsibilities

• Integrate automatedsecurity testing (SAST, DAST, SCA, container and image scanning) into CI/CDpipelines, enforcing security gates before deployment.
• Define and maintainsecurity-as-code and policy-as-code controls, including infrastructure ascode (IaC) scanning for cloud and on-premises environments.
• Harden containerand orchestration platforms such as Docker and Kubernetes, enforcingleast-privilege access, image signing, and runtime security controls.
• Manage secrets,credentials, and certificates through centralized secrets management,eliminating hard-coded credentials across pipelines and services.
• Monitor, triage,and prioritize vulnerabilities across code, dependencies, images, andinfrastructure, driving remediation with development teams against definedSLAs.
• Automate securitybaseline enforcement and compliance evidence collection across cloud andon-premises environments.
• Collaborate withdevelopment teams to embed secure coding practices, threat modeling, andsecurity requirements early in the development cycle.
• Support incidentresponse and post-incident reviews for security events affecting pipelines,infrastructure, and workloads, driving root-cause remediation.
• Continuouslyimprove security tooling coverage and accuracy, reducing false positives andmean time to remediate.
• Participate in the on-call rotation to supportproduction systems.

Key Performance Indicators/ Key Success Factors

• Percentage of CI/CD pipelines with enforcedsecurity gates (SAST/DAST/SCA coverage).
• Mean time to remediate (MTTR) critical andhigh-severity vulnerabilities.
• Reduction in vulnerabilities reachingproduction.
• Compliance with security baselines acrosscloud and on-premises environments.
• Secrets management coverage, with zerohard-coded credentials in code and pipelines.