DevSecOps Engineer

BGTS International; Beşiktaş; On-site; TRY 300,000 - 540,000; Full time

Job summary

BGTS International is seeking a DevSecOps security expert to join Beşiktaş-based operations. You will oversee CI/CD security, manage SonarQube and Fortify, and integrate secure practices into the pipeline while supporting DevOps activities as needed.

The role requires hands‑on cloud/security experience across ecosystems (AWS/Azure/GCP), container and IaC tooling, and a mindset of automation and continuous improvement.

Qualifications

• Experience in DevSecOps, cloud and application security across AWS, Azure, GCP and on‑prem environments.
• Hands‑on CI/CD, Secure SDLC and security controls in pipelines across source, dependencies, Dockerfiles and IaC.
• Experience integrating SAST/SCA, container security and IaC scanning into CI/CD workflows.

Responsibilities

• Understand and optimize the existing DevSecOps pipeline structure and controls.
• Effectively manage SonarQube/Fortify and similar tools within pipelines.
• Integrate new security requirements into CI/CD workflows and automate where possible.
• Contribute hands‑on to DevOps operations when needed to maintain reliability.

Skills

DevSecOps

Cloud Security

Application Security

DevOps

CI/CD

Secure SDLC

SAST

SCA

Container security

IaC scanning

SonarQube

Fortify

Remediation processes

Security gates

Pipeline policies

Docker

Kubernetes

IAM

Secrets management

Privileged access

Git

Terraform

Helm

Linux

Automation

Policy as code

Python

Bash

PowerShell

Tools

Prisma Cloud

CyberArk Conjur

Kubernetes security tools

Python

Bash

PowerShell

Job description

Requirements

• Experience in DevSecOps, Cloud Security, Application Security, or DevOps
• Hands-on experience working in AWS, Azure, Google Cloud, and on-prem environments
• Strong knowledge and hands-on experience in CI/CD pipelines and Secure SDLC processes
• Experience with security controls for source code, dependencies, Dockerfiles, container images, Helm charts, and Infrastructure as Code within the pipeline
• Knowledge of integrating and managing SAST, SCA, container security, IaC scanning, and similar controls into CI/CD processes
• Experience working with SonarQube, Fortify, or similar application security tools
• Evaluating, prioritizing, and managing remediation processes for findings resulting from security scans
• Command of security gate, quality gate, and pipeline policy approaches
• Strong technical knowledge in the Docker and Kubernetes ecosystem
• Command of IAM, secrets management, and privileged access management principles in multi-cloud / hybrid structures
• Experience with Git, Terraform, Helm, and similar DevOps / Infrastructure as Code technologies
• Technical competence in Linux systems, troubleshooting, and providing hands-on support to existing DevOps operations
• Ability to develop security controls not just by operating them, but with a mindset of automation, standardization, and continuous improvement

Preferred

• Experience in Prisma Cloud or similar CNAPP / CSPM / CWPP solutions
• Experience in CyberArk Conjur or similar PAM / secrets management solutions
• Experience in Kubernetes security, admission control, policy-as-code, and runtime security
• Ability to develop automation with Python, Bash, or PowerShell
• Experience in false-positive management, rule/policy tuning in DevSecOps tools, and optimizing security controls without disrupting developer experience
• Experience working with monitoring, logging, and observability tools

The profile we are looking for is a teammate who does not just use security tools; but can understand the existing DevSecOps pipeline structure, effectively manage SonarQube/Fortify and similar controls, integrate new security requirements into the pipeline, and directly contribute to DevOps operations when necessary.