Security Engineer

Adree; Saudi Arabia; On-site; SAR 262,000 - 375,000; Full time

Job summary

A cybersecurity firm in Saudi Arabia is seeking an experienced security engineer to operationalize DevSecOps security controls throughout the SDLC and CI/CD processes. The ideal candidate has 5–8+ years of AppSec/DevSecOps experience along with strong knowledge in OWASP and threat modeling. Responsibilities include automating SSL/TLS certificate management, integrating SBOM tools into CI/CD pipelines, and implementing image verification protocols for code integrity. This role involves working with tools like Azure DevOps Server and Fortify, and requires strong communication skills.

Qualifications

• 5–8+ years of AppSec/DevSecOps/security engineering experience.
• Government/regulatory sector experience is a plus.
• Strong OWASP, threat modeling, and vulnerability management exposure.

Responsibilities

• Configure and tune Fortify SAST/DAST to define thresholds.
• Automate renewal of SSL/TLS certificates in Kubernetes.
• Integrate SBOM generation tools for tracking dependencies.
• Implement image signing and verification for code integrity.
• Define Quality Gates and vulnerability SLAs with dashboards.
• Integrate secrets management and secure access patterns.
• Support compliance evidence and scan outputs.
• Partner with DevOps and QA on secure pipelines.

Skills

Secure SDLC

CI/CD security gates

Secrets management

Container security concepts

K8s security basics

Influence without authority

Risk-based communication

Pragmatic guidance

Calm escalation handling

Tools

Azure DevOps Server

Fortify (SAST/DAST)

HashiCorp Vault

JFrog Artifactory

Sigstore

OpenShift

Kubernetes

AppDynamics

BMC

Azure Monitoring

Job description

Role Summary

Operationalize DevSecOps security controls across SDLC and CI/CD using Azure DevOps Server, ensuring enforceable security gates, vulnerability lifecycle management, and audit‑ready evidence.

Key Responsibilities

• Configure and tune Fortify SAST/DAST, define thresholds and exception workflow.
• Automate the renewal and deployment of SSL/TLS certificates using tools like HashiCorp Vault and Cert-Manager in Kubernetes to prevent downtime and security risks.
• Integrate SBOM generation tools into the CI/CD pipeline to track component dependencies, license compliance, and vulnerabilities, providing visibility into the software supply chain.
• Implement image signing and verification using tools like Sigstore/Cosign to ensure code integrity, ensuring only verified, trusted container images are deployed.
• Define Quality Gates, vulnerability SLAs, triage process, remediation tracking and reporting dashboards.
• Integrate secrets management (HashiCorp Vault) and secure access patterns with SecurEnvoy MFA.
• Support compliance evidence: scan outputs, approvals, and release evidence packs.
• Partner with DevOps and QA on secure pipelines and test environment controls.

Required Experience

• 5–8+ years AppSec/DevSecOps/security engineering experience.
• Government/regulatory sector experience is a plus.
• Strong OWASP, threat modeling, and vulnerability management exposure.
• Technical Skills: Secure SDLC, CI/CD security gates, artifact trust, secrets management, container security concepts, and K8s security basics.
• Soft Skills: Influence without authority, risk-based communication, pragmatic guidance, and calm escalation handling.
• Core Skills / Tooling: Azure DevOps Server, Fortify (SAST/DAST), HashiCorp Vault, JFrog Artifactory, Sigstore (plus), OpenShift/Kubernetes awareness, monitoring correlation (AppDynamics/BMC/Azure Monitoring).