Dev SecOps Engineer

solaireresort; Parañaque; On-site; PHP 600,000 - 900,000; Full time

Job summary

solaireresort seeks an experienced DevSecOps/security engineer to integrate automated security testing into CI/CD pipelines and define security-as-code controls. You will harden container platforms like Docker and Kubernetes, manage secrets centrally, and drive remediation with development teams to meet SLAs.

The role covers cloud and on-premises environments, with on-call support for production systems. You will collaborate across teams to embed secure coding practices and threat modeling early

Qualifications

• Bachelor's degree in computer science, engineering, or a related field or equivalent practical experience.
• 3+ years in a DevSecOps/DevOps or security engineering role with high-availability platforms.
• Proficiency with CI/CD tools and multiple security scanners.
• Experience with IaC, cloud platforms, and secrets management.

Responsibilities

• Integrate SAST/DAST/SCA and container security into CI/CD pipelines.
• Maintain security-as-code and policy-as-code controls including IaC scanning.
• Harden Docker and Kubernetes with least-privilege, image signing, and runtime controls.
• Manage secrets across pipelines using centralized secrets management.
• Monitor, triage, and remediate vulnerabilities across code, images, and infra.
• Collaborate with dev teams to embed secure coding practices and threat modeling.
• Support incident response and post-incident reviews affecting pipelines and workloads.
• Contribute to continuous improvement of security tooling and reduce false positives.

Skills

CI/CD tooling

Security testing

Threat modeling

SAST/DAST/SCA

Kubernetes

Education

Bachelor's degree

Tools

Jenkins

GitLab CI

GitHub Actions

SonarQube

Snyk

Trivy

OWASP ZAP

Terraform

Docker

Kubernetes

HashiCorp Vault

Job description

Duties and Responsibilities

Integrate automated security testing (SAST, DAST, SCA, container and image scanning) into CI/CD pipelines, enforcing security gates before deployment. Define and maintain security-as-code and policy-as-code controls, including infrastructure as code (IaC) scanning for cloud and on-premises environments. Harden container and orchestration platforms such as Docker and Kubernetes, enforcing least-privilege access, image signing, and runtime security controls. Manage secrets, credentials, and certificates through centralized secrets management, eliminating hard-coded credentials across pipelines and services. Monitor, triage, and prioritize vulnerabilities across code, dependencies, images, and infrastructure, driving remediation with development teams against defined SLAs. Automate security baseline enforcement and compliance evidence collection across cloud and on-premises environments. Collaborate with development teams to embed secure coding practices, threat modeling, and security requirements early in the development cycle. Support incident response and post-incident reviews for security events affecting pipelines, infrastructure, and workloads, driving root-cause remediation. Continuously improve security tooling coverage and accuracy, reducing false positives and mean time to remediate. Participate in the on-call rotation to support production systems.

Key Performance Indicators/ Key Success Factors

Percentage of CI/CD pipelines with enforced security gates (SAST/DAST/SCA coverage).

Mean time to remediate (MTTR) critical and high-severity vulnerabilities.

Reduction in vulnerabilities reaching production.

Compliance with security baselines across cloud and on-premises environments.

Secrets management coverage, with zero hard-coded credentials in code and pipelines.

Requirements

Education: Bachelor's degree in computer science, Engineering, or a related field, or equivalent practical experience.

Experience: 3+ years in a DevSecOps, DevOps, or security engineering role, ideally supporting high-availability, real-time platforms such as online gaming.

Skills & Knowledge: Proficiency with CI/CD tools (Jenkins, GitLab CI, GitHub Actions), security scanning tools (SonarQube, Snyk, Trivy, OWASP ZAP), containerization/orchestration (Docker, Kubernetes), infrastructure as code (Terraform), cloud platforms (AWS/Azure/GCP), secrets management (HashiCorp Vault), and scripting (Python, Bash).

Certifications (good to have): Certified Kubernetes Security Specialist (CKS), AWS Certified Security - Specialty, GIAC Cloud Security Automation (GCSA), or CISSP preferred.