Senior DevSecOps

EY; Taguig; Hybrid; PHP 1,200,000 - 2,400,000; Full time

Benefits offered by this job

Support and feedback from colleagues

Career development opportunities

Flexible work style

Job summary

EY Philippines is seeking a Senior Consultant – DevSecOps / Application Security to embed security across the software lifecycle. You will drive secure design and hands-on security assessments, integrating security into CI/CD pipelines and cloud environments (AWS/Azure/GCP).

Role focuses on Security as Code, automation, and AI-assisted security use cases, collaborating with DevOps, Architects, and Developers.

Qualifications

• BE/B.Tech/MCA required.
• Mandatory security certifications: AZ-500 or AWS SCS-C01.
• Knowledge of Windows, Linux, UNIX.

Responsibilities

• Implement SSDLC/DevSecOps across SDLC and CI/CD pipelines.
• Perform application security assessments (SAST/DAST/SCA).
• Integrate security tools into CI/CD and automate testing.
• Support secure coding, remediation, and code reviews.
• Collaborate with DevOps/cloud teams to enforce security in AWS/Azure/GCP.
• Develop automation scripts for security testing and reporting.

Job description

As part of our Cyber Security team, you will implement and support Secure SDLC (SSDLC) and DevSecOps practices across the software development lifecycle, ensuring security is embedded into design, development, testing, and deployment stages.

You will perform hands-on security assessments of applications, APIs, and supporting infrastructure, and work closely with DevOps, Architects, Developers, and QA teams to integrate security into CI/CD pipelines. You will analyze security findings, provide remediation guidance, and contribute to building secure, scalable application delivery practices.

The Opportunity

We’re looking for a Senior Consultant – DevSecOps / Application Security with strong hands-on expertise in secure SDLC and pipeline security. This role offers the opportunity to work on end-to-end DevSecOps implementations, supporting clients and engineering teams in embedding security across CI/CD pipelines.

You will collaborate with cross-functional teams to implement Security as Code (SaC), automation, and cloud-native security controls, while contributing to the adoption of AI-assisted security capabilities and modern application security practices.

Your Key Responsibilities

• Implement Secure SDLC (SSDLC) practices across application development and CI/CD pipelines.
• Perform application security assessments including SAST, DAST, SCA, and basic threat modeling.
• Integrate and automate security tools within CI/CD pipelines (e.g., secret scanning, IaC scanning, container security).
• Support development teams in secure coding practices, vulnerability remediation, and code reviews.
• Work on DevSecOps pipeline implementation and optimization using enterprise and open-source tools.
• Assist in threat modeling exercises (e.g., STRIDE) and secure design reviews.
• Develop scripts and automation for security testing, reporting, and tool integration.
• Collaborate with DevOps and cloud teams to implement security controls in cloud environments (AWS/Azure/GCP).
• Analyze security findings and create detailed reports with risks, exploitation scenarios, and remediation steps.
• Support adoption of container security, IaC security, and compliance-as-code practices.
• Contribute to AI-assisted security use cases, such as automated triaging, code analysis, and developer productivity tools.
• Stay current with emerging security threats, vulnerabilities, and DevSecOps trends.

Skills and Attributes for Success

• Strong hands-on experience in application security testing (SAST, DAST, SCA).
• Experience working with CI/CD pipelines and DevOps tools (Jenkins, Azure DevOps, GitHub/GitLab).
• Proficiency in scripting/programming (Python, PowerShell, Java, etc.).
• Familiarity with DAST tools (Burp Suite, WebInspect, AppScan), SAST,SCA tools (Checkmarx, Fortify, Veracode, Coverity), Container security tools (Aqua, Invicti etc.), Secret scanning tools (GHAS Git Guardian etc.).
• Understanding of OWASP Top 10 and secure coding practices.
• Experience with cloud platforms (AWS/Azure/GCP) and basic cloud security concepts.
• Exposure to container technologies and security tools (Docker, Kubernetes).
• Understanding of DevSecOps practices and SSDLC frameworks (OWASP SAMM, NIST SSDF).
• Hands-on experience with SCM tools (GitHub, GitLab, Bitbucket) and pipeline integrations.
• Good understanding of threat modeling concepts (e.g., STRIDE).
• Exposure to AI/ML or GenAI tools in development/security workflows (e.g., AI-assisted code analysis, automation).
• Strong problem-solving skills and ability to work in cross-functional teams.

To qualify for the role, you must have

• BE/ B.Tech/ MCA.
• Certifications: Mandatory to have any one of the below certifications,
  • Azure Security Architect (Az-500)
  • AWS security speciality certification (SCS-C01)
• Knowledge of Windows, Linux, UNIX, any other major operating systems.
• Strong Excel and PowerPoint skills.

Ideally, you’ll also have

• Certifications: CSSLP, Certified DevSecOps Professional

What we look for

• A candidate who can build a complete CI/CD pipeline from scratch, prepare, and work around a maturity model and optimize the pipeline to integrate the best tools according to the client requirement.

What working at EY offers

At EY, we’re dedicated to helping our clients, from start-ups to Fortune 500 companies — and the work we do with them is as varied as they are.

You get to work with inspiring and meaningful projects. Our focus is education and coaching alongside practical experience to ensure your personal development. We value our employees and you will be able to control your own development with an individual progression plan. You will quickly grow into a responsible role with challenging and stimulating assignments. Moreover, you will be part of an interdisciplinary environment that emphasizes high quality and knowledge exchange. Plus, we offer:

• Support, coaching and feedback from some of the most engaging colleagues around
• Opportunities to develop new skills and progress your career
• The freedom and flexibility to handle your role in a way that’s right for you

About EY

As a global leader in Assurance, Tax, Strategy & transactions and Consulting services, we’re using the finance products, expertise and systems we’ve developed to build a better working world. That starts with a culture that believes in giving you the training, opportunities and creative freedom to make things better. Whenever you join, however long you stay, the exceptional EY experience lasts a lifetime. And with a commitment to hiring and developing the most passionate people, we’ll make our ambition to be the best employer by 2020 a reality.