DevSecOps Engineer

Contour Software; Islamabad Capital Territory; On-site; PKR 2,000,000 - 3,200,000; Full time

Job summary

Contour Software Pvt Ltd is seeking a Security Engineer to co‑own the DevSecOps program, drive security automation, and ensure PCI DSS 4.0 readiness for a multi‑tenant PayFac platform on AWS. You will implement SAST/DAST/IAAC scanning, enforce strong authentication and data protection, and partner with compliance for audits.

The role emphasizes secure by default surface area, threat modeling, and incident response readiness, working with ISV integrations and security champions across functions.

Qualifications

• Experience building secure software in cloud environments.

Responsibilities

• Own CI/CD security toolchain design and implementation (SAST/DAST/SCAs).
• Lead vulnerability management SLAs and risk acceptance workflows.
• Harden AWS/EKS workloads and implement IAM least-privilege.
• Develop secure integration patterns for ISV platforms and payment APIs.

Skills

Security engineering

DevSecOps

AWS

PCI DSS

Threat modeling

Education

Bachelor's degree in CS/IS or related field

Tools

SAST

DAST

OWASP

JIRA

Job description

Job Description:

About Contour

Contour Software has grown from a dozen people to over 2,000 staff across 3 cities, in less than 14 years.

As a subsidiary of Constellation Software Inc., we are proud to be part of a global enterprise software conglomerate that has grown to become one of the top 10 software companies in the world, with employees and customers in 100+ countries. With a broad-based and ever-growing portfolio of market-leading, vertical-market enterprise solutions covering more than 100 industry domains in predominantly mature markets, CSI's recipe creates the perfect environment for professionals to build fulfilling, long-term careers.

What started as an R&D & Accounting back-office, has progressed into a full-service Global Centre serving all functions and departments, at the divisional as well as operating group/corporate level. Today Contour employees, located in Karachi, Lahore & Islamabad, are serving CSI divisions located in time zones spanning the globe, from Sydney to Vancouver. With the global growth of Constellation as the wind in our sails, we are only just getting started!

About the Role

Constellation Payment Processing is a modern Payment Facilitator (PayFac) empowering SaaS businesses to grow revenue through seamless, embedded payments. As part of Constellation Software Inc. (TSE:CSU) — a global Canadian-based software leader at a $96B market cap and the 7th largest software company in the world — we combine the agility of a specialized payments company with the strength and stability of an established global powerhouse.

We’re building a cloud-native PayFac platform on AWS: microservices (DDD) across TypeScript/JavaScript, Java, and Ruby, with a ReactJS front end. As our Security Engineer, you’ll co‑own the DevSecOps program—driving continuous security automation, compliance automation, and penetration testing. You’ll design and orchestrate

SAST/SCA/DAST across our services, champion remediation practices, and partner closely with our compliance team to translate control objectives into repeatable, automated evidence.

Our customers are ISV vendors who embed payments by integrating with our APIs, SDKs, and webhooks. That means security and compliance aren’t afterthoughts—they’re product features. You’ll ensure our developer‑facing surface area is secure by default: establishing standards for authentication and authorization (OIDC/OAuth2/JWT, mTLS/JWS for webhooks), key and secret management, request signing, idempotency, rate‑limiting/abuse controls, and secure data handling that minimizes PCI scope for ISVs (tokenization, hosted fields/iframes, PAN vault boundaries, network tokens). You’ll create secure integration patterns (reference apps, checklists, threat models/DFDs) so partners can implement quickly without compromising controls.

Because we operate a multi‑tenant PayFac, you’ll harden isolation boundaries (network, identity, and data), lead supply‑chain security (SBOMs, signing/provenance, gated deployments), and build continuous evidence for PCI DSS 4.0 (and SOC 2/ISO as needed). You’ll collaborate with partner security and compliance teams on due‑diligence requests (SIG Lite, AOC/ROCs, shared‑responsibility matrices), and you’ll own pre‑launch security reviews for new ISV integrations. You’ll also help run incident response drills and define partner‑facing comms and SLAs for security events.

Finally, you’ll research and implement AI‑assisted security (triage, anomaly detection, auto‑remediation PRs) with appropriate guardrails, and own KPIs that demonstrate multiplier effects—e.g., reduced MTTR, lower false‑positive rates, higher auto‑triage coverage, and faster time‑to‑evidence—so our platform’s security posture continuously improves as our ISV ecosystem scales.

What You’ll Do

• Own Security Automation Design, implement, and run the CI/CD security toolchain: SAST, SCA, DAST, container and IaC scanning, secrets detection, SBOM generation, and policy-as-code.
• Integrate scanners into GitHub/GitHub Actions pipelines with PR gates, and auto‑ticketing to JIRA; tune noise, baselines, and break‑glass rules.
• Establish vulnerability management SLAs, risk acceptance workflow, and metrics dashboards (e.g., MTTR, vuln burn‑down).
• Embed Security in the SDLC Create lightweight secure‑coding standards and review checklists for TypeScript/Node, Java, Ruby, React. Run threat modeling (STRIDE/PASTA) and produce DFDs (L0–L2) for new and high‑risk flows. Lead a “security champions” program with engineering squads.
• Platform & Cloud Security (AWS/EKS) Harden EKS workloads (admission controls, pod security, image signing, runtime protection), ECR scanning, and supply‑chain security. Implement and iterate on IAM least‑privilege, KMS/CloudHSM key management, network segmentation, WAF/Shield, CloudFront, GuardDuty/Security Hub, and centralized logging. Validate service‑to‑service auth (mTLS, OIDC, JWT), secrets management (AWS Secrets Manager/SSM), and data protection at rest/in transit (FIPSvalidated crypto). Manage security certificate adoption our own and 3rd party across the company technology stack
• Compliance Automation Map controls and automate evidence for PCI DSS 4.0 (and SOC 2/ISO 27001 as needed): continuous monitoring, detector‑to‑control mappings, and audit‑ready artifacts. Partner with compliance on policies, risk register, third‑party/vendor assessments, and control testing cadence.
• Penetration Testing & Response Scope and coordinate internal and third‑party penetration tests (API, web, mobile, cloud); plan fix‑verification and retests.
• Contribute to incident response playbooks, tabletop exercises, and forensics runbooks.
• Participate in incident response events and be a key contributor on improving security posture
• Research & implement AI security tools: Evaluate and deploy AI/ML capabilities (LLM‑assisted code reviews, AI triage for SAST/SCA/DAST, anomaly detection over logs/telemetry, drift detection) to reduce toil and