Senior DevSecOps Engineer

SM Investments Corporation; Pasay; On-site; PHP 1,200,000 - 2,000,000; Full time

Job summary

SM Investments Corporation in the Philippines seeks a seasoned DevSecOps security professional to automate controls across CI/CD pipelines, secure multi-cloud environments, and harden container platforms. You will implement IaC security, enforce IAM best practices, apply security frameworks, and drive threat modeling, vulnerability management, and compliance automation.

The role requires hands-on expertise with Terraform, Kubernetes, Snyk, SonarQube, and Fortify, plus experience with JFrog/Nexus

Qualifications

• Strong expertise in DevSecOps and secure SDLC practices.
• Experience implementing security controls in CI/CD pipelines.
• Familiarity with cloud security in multi-cloud environments.
• Proficient in IaC security using Terraform or CloudFormation.
• Knowledge of IAM, RBAC, and federated identity standards.
• Experience with security testing tools (SAST/DAST/SCA).

Responsibilities

• Automate security controls within CI/CD pipelines.
• Secure cloud environments and container platforms.
• Integrate security testing tools (SAST/DAST/SCA).
• Implement IaC security.
• Enforce IAM best practices and federated identities.
• Apply security frameworks and compliance automation.
• Perform threat modeling, risk assessments, and vulnerability management.
• Secure DevOps toolchains and repos (JFrog/Nexus, source control).
• Implement Zero Trust principles and cloud-native controls.
• Maintain audit trails, enforce policies (OPA, AWS Config).
• Deep knowledge of cloud and container security.
• Hands-on with IaC security and automation.
• Familiarity with Kubernetes security (RBAC, network policies).
• Proficiency in security tools and automation frameworks.
• Experience with compliance-as-code tools (Chef InSpec, OpenSCAP)

Skills

CI/CD security

Cloud security

IaC security

Zero Trust

DevSecOps

Container security

Threat modeling

Security automation

SAST/DAST/SCA

RBAC

Tools

Jenkins

GitLab

CircleCI

GitHub Actions

AWS

Azure

GCP

Docker

Kubernetes

Terraform

CloudFormation

Snyk

SonarQube

Checkmarx

Fortify

OPA

OpenSCAP

JFrog/Nexus

Job description

At SM Investments, we shape sustainable growth stories that move industries and uplift communities. As one of the Philippines’ leading conglomerates, we build opportunities across retail, banking, and property guided by excellence, integrity, and innovation.

Key Responsibilitie

• Automate security controls within CI/CD pipelines (Jenkins, GitLab, CircleCI, GitHub Actions
• Secure cloud environments (AWS, Azure, GCP) and container platforms (Docker, Kubernetes)
• Integrate security testing tools (SAST, DAST, SCA) such as Snyk, SonarQube, Checkmarx, or Fortify
• Implement Infrastructure as Code (IaC) security using Terraform and CloudFormation
• Enforce IAM best practices, RBAC, and federated identity (SAML, OAuth, Cognito)
• Apply security frameworks (ISO 27001, NIST, CIS) and compliance automation
• Perform threat modeling, risk assessments, and vulnerability management
• Secure DevOps toolchains, artifact repositories (JFrog, Nexus), and source control system
• Implement Zero Trust principles and cloud-native security controls
• Maintain audit trails, enforce policies (OPA, AWS Config), and ensure governance compliance
• Strong expertise in DevSecOps practices and secure SDLC
• Deep knowledge of cloud and container security
• Hands-on experience with IaC security and automation
• Familiarity with Kubernetes security (RBAC, network policies, secrets management)
• Proficiency in security tools and automation frameworks
• Experience with compliance-as-code tools (Chef InSpec, OpenSCAP)

Preferred Experience

• Proven experience in DevSecOps within platform engineering environments, building secure and scalable developer platforms
• Hands-on expertise with Terraform, including securing Terraform modules, state management, and IaC pipelines
• Experience designing and securing internal developer platforms (IDPs) or platform-as-a-service (PaaS) environments
• Strong background in automating security controls at scale across cloud-native architectures
• Experience with Cloud Security Posture Management (CSPM) tools such as Prisma Cloud or Dome9
• Exposure to enterprise-grade security architecture and governance frameworks