DevSecOps Lead

NCS Group; Taguig; On-site; PHP 1,500,000 - 2,300,000; Full time

Job summary

NCS Group is seeking a DevSecOps Lead to drive security into our DevOps lifecycle and cloud infrastructure. You will design, implement, and secure scalable environments while ensuring compliance with industry standards.

The role emphasizes collaboration with development, operations, and security teams, conducting regular security assessments, and guiding the organization in best practices for secure CI/CD and incident response.

Qualifications

• Deep expertise in cloud services (EC2, S3, RDS, Lambda, IAM, VPC, CloudFormation, etc.).
• Proficiency with infrastructure as code tools such as Terraform or CloudFormation.
• Extensive experience with CI/CD tools like Jenkins, GitLab CI, or CodePipeline.
• Strong knowledge of advanced security best practices and frameworks (NIST, CIS, OWASP).
• Experience with GuardDuty, Inspector, and WAF.
• Proficiency in scripting languages (Python, Bash, PowerShell).
• Familiarity with Docker and Kubernetes and their security aspects.
• Solid understanding of networking and network security concepts.

Responsibilities

• Lead the design, implementation, and management of secure, scalable cloud infrastructure.
• Develop and implement advanced security practices within the DevOps lifecycle.
• Architect and maintain CI/CD pipelines with integrated security checks.
• Ensure compliance with GDPR, HIPAA, PCI-DSS, and internal standards.
• Lead incident response activities and root-cause analysis; remediation planning.
• Collaborate with development, operations, and security teams; mentor peers.

Skills

Cloud services

Infrastructure as code

CI/CD tools

Security best practices

Scripting languages

Containerization

Network security

Tools

Terraform

CloudFormation

Jenkins

GitLab CI

CodePipeline

GuardDuty

Inspector

WAF

Docker

Kubernetes

Job description

General Responsibilities

The DevSecOps Lead is responsible for leading the integration of robust security practices into our DevOps pipeline, ensuring the protection and compliance of our cloud infrastructure. This role demands a strategic mindset to optimize system performance and reliability while fostering a culture of security within the organization.

Duties And Responsibilities

Cloud Infrastructure Management

• Lead the design, implementation, and management of scalable, secure, and resilient cloud infrastructure
• Monitor and optimize cloud resource usage and performance, making strategic improvement recommendations.

Security Integration

• Develop and implement advanced security practices within the DevOps lifecycle.
• Conduct regular security assessments, vulnerability scanning, and penetration testing.
• Implement and manage robust security controls, policies, and procedures.

Continuous Integration/Continuous Deployment (CI/CD)

• Architect and maintain CI/CD pipelines to automate and secure deployment processes.
• Ensure integration of advanced security checks within the CI/CD pipelines.

Compliance And Governance

• Ensure adherence to industry regulations (e.g. GDPR, HIPAA, PCI-DSS) and internal compliance standards.
• Implement and manage comprehensive compliance monitoring tools and frameworks.
• Prepare and maintain detailed documentation for audits and compliance requirements.

Monitoring And Incident Response

• Implement and manage sophisticated monitoring tools for cloud infrastructure and applications.
• Develop and maintain incident response plans and procedures.
• Lead complex incident response activities, including root cause analysis and comprehensive remediation.

Collaboration And Leadership

• Foster a collaborative environment by working closely with development, operations, and security teams.
• Collaborate with cross-functional teams, including developers, operations, and security, to ensure seamless integration of security practices.
• Facilitate knowledge sharing, and provide training, mentorship, and guidance on DevSecOps principles and practices to team members.
• Communicate effectively with stakeholders to report on security posture, incidents, and strategic improvements.
• Other job-related activities that may be assigned from time to time.

Minimum Qualifications

• Deep expertise in Cloud services (EC2, S3, RDS, Lambda, IAM, VPC, CloudFormation, etc.).
• Proficiency in infrastructure as code (IaC) tools such as Terraform or CloudFormation.
• Extensive experience with CI/CD tools such as Jenkins, GitLab CI, or CodePipeline.
• Strong knowledge of advanced security best practices and frameworks (NIST, CIS, OWASP, etc.).
• Experience with advanced security tools such as, GuardDuty, Inspector, and WAF.
• Proficiency in scripting languages such as Python, Bash, or PowerShell.
• Familiarity with containerization technologies (Docker, Kubernetes) and their security aspects.
• Strong understanding of networking and network security concepts.

Qualifications

• Had background in Architecture, Automation and security as a DevSecOps