Microservices Security Specialist.

Sasso Consulting (Pty) Ltd; Johannesburg; On-site; ZAR 700,000 - 1,000,000; Full time

Job summary

Sasso Consulting (Pty) Ltd is seeking experienced Microservices Security Specialists to design, implement and continuously improve security controls across enterprise microservices, containerised apps and cloud-native environments.

You will secure distributed applications, APIs, containers and service-to-service communications, applying Zero Trust and secure software development practices. Strong hands-on experience and collaboration with development teams are essential.

Qualifications

• Relevant diploma or degree in Information Technology, Computer Science, Software Engineering, Cybersecurity or related discipline.
• Typically 3-5 years of relevant experience in application security, DevSecOps, cloud-native security or microservices security.
• Proven hands-on experience implementing security controls within microservices or distributed application environments.
• Strong understanding of microservices architecture and secure application design principles.
• Practical experience securing REST APIs and service-to-service communications.
• Knowledge of OAuth 2.0, OpenID Connect, JWT and TLS/mTLS.
• Experience with Docker and Kubernetes environments.

Responsibilities

• Design, implement and maintain security controls across enterprise microservices architectures.
• Assess security of distributed applications, APIs and container environments.
• Apply Zero Trust principles to service-to-service authentication and authorisation.
• Secure REST and GraphQL APIs, API gateways and service-to-service communications.
• Configure Kubernetes RBAC, network policies and container security controls.
• Integrate security into CI/CD pipelines and DevSecOps practices.
• Monitor security events and coordinate remediation across cloud-native environments.
• Collaborate with development teams to enforce secure by design principles.
• Maintain compliance with security standards and best practices.

Skills

Microservices architecture

OAuth 2.0

OpenID Connect

JWT

TLS/mTLS

Kubernetes security

RBAC

Container security

DevSecOps

Threat modelling

Education

Diploma or degree in IT/CS/Cybersecurity

Tools

Trivy

Aqua Security

Prisma Cloud

Sysdig

Falco

Kubescape

Job description

Microservices Security Specialist

Location: Centurion, Gauteng (provisional - to be confirmed)
Positions Available: 5
Salary: Market-related
Employment Type: To be confirmed

Job Overview

We are seeking experienced and technically proficient Microservices Security Specialists to design, implement, manage and continuously improve security controls across enterprise microservices architectures, containerised applications and cloud-native environments.

The successful candidates will be responsible for securing distributed applications, APIs, containers, Kubernetes environments and service-to-service communications against cybersecurity threats, vulnerabilities and unauthorised access.

This role requires strong hands-on expertise in microservices security, API protection, container security, DevSecOps, secure application architecture and cloud-native security technologies.

The ideal candidates will have proven experience implementing security controls within enterprise microservices environments, with a strong understanding of secure software development, application security testing, identity management and Zero Trust security principles.

Key Responsibilities

Microservices Security Architecture and Implementation

• Design, implement and maintain security controls across enterprise microservices architectures.
• Conduct security assessments of distributed applications and microservices environments.
• Identify and remediate security vulnerabilities within microservices, APIs and supporting infrastructure.
• Implement secure communication mechanisms between microservices and distributed applications.
• Apply Zero Trust principles to service-to-service authentication and authorisation.
• Support the development of secure microservices architecture standards and security design patterns.
• Conduct threat modelling and security architecture reviews for cloud-native applications.
• Collaborate with software architects and development teams to implement security-by-design principles.
• Ensure microservices security controls align with organisational security policies and recognised industry standards.

API Security and Service-to-Service Protection

• Implement and maintain security controls for RESTful APIs, GraphQL APIs and microservices endpoints.
• Configure secure API authentication and authorisation mechanisms.
• Implement OAuth 2.0, OpenID Connect, JSON Web Tokens (JWT) and mutual TLS (mTLS).
• Secure API gateways and manage API access policies.
• Identify and mitigate common API vulnerabilities, including those outlined in the OWASP API Security Top 10.
• Implement API rate limiting, request validation and traffic protection mechanisms.
• Secure service-to-service communications within distributed environments.
• Monitor API security events and investigate suspicious access patterns.
• Support API security testing and vulnerability remediation.

Container and Kubernetes Security

• Implement security controls across Docker and Kubernetes environments.
• Conduct container image vulnerability assessments and security configuration reviews.
• Secure container registries, runtime environments and orchestration platforms.
• Configure Kubernetes Role-Based Access Control (RBAC), network policies and workload security controls.
• Implement secure secrets management and container authentication mechanisms.
• Monitor container and Kubernetes security events.
• Identify and remediate misconfigurations within containerised environments.
• Apply security hardening standards to Kubernetes clusters and workloads.
• Support container runtime protection and cloud-native threat detection.
• Collaborate with infrastructure and DevOps teams to maintain secure container platforms.

DevSecOps and Secure Software Development

• Integrate security controls into software development and CI/CD pipelines.
• Implement automated application security testing within development workflows.
• Support Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA).
• Identify vulnerabilities in application code, third-party dependencies and container images.
• Implement secure coding standards and software supply chain security controls.
• Support Infrastructure as Code (IaC) security scanning and configuration validation.
• Collaborate with development teams to remediate security findings.
• Promote secure software development lifecycle (SSDLC) practices.
• Support continuous security monitoring and automated compliance checks.

Cloud-Native Security and Infrastructure Protection

• Implement security controls for microservices deployed across Microsoft Azure, AWS or Google Cloud environments.
• Secure cloud-native application platforms and managed Kubernetes services.
• Configure network segmentation and secure connectivity between microservices.
• Implement cloud identity and access management controls.
• Secure application secrets, cryptographic keys and sensitive configuration information.
• Support service mesh security implementations.
• Implement workload identity and secure service authentication.
• Assess cloud-native infrastructure for vulnerabilities and security misconfigurations.
• Support security monitoring, logging and incident response within distributed application environments.

Security Monitoring, Risk Management and Compliance

• Monitor microservices and API security events using relevant security monitoring tools.
• Investigate application security incidents and coordinate remediation activities.
• Conduct vulnerability assessments and security risk reviews.
• Maintain security documentation, assessment reports and remediation records.
• Support security audits and compliance assessments involving cloud-native applications.
• Implement security controls aligned with ISO 27001, NIST and OWASP guidance.
• Monitor emerging microservices, container and API security threats.
• Recommend improvements to application security architecture and operational processes.
• Provide technical guidance to development, DevOps and infrastructure teams.

Minimum Requirements

• Relevant diploma or degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Information Security or a related discipline.
• Typically 3-5 years of relevant experience in application security, DevSecOps, cloud-native security or microservices security.
• Proven hands-on experience implementing security controls within microservices or distributed application environments.
• Strong understanding of microservices architecture and secure application design principles.
• Practical experience securing REST APIs and service-to-service communications.
• Strong knowledge of OAuth 2.0, OpenID Connect, JWT and TLS/mTLS.
• Experience implementing or assessing security controls within Docker and Kubernetes environments.
• Understanding of Kubernetes RBAC, network policies, secrets management and container security.
• Experience with application security testing tools and methodologies.
• Knowledge of OWASP Top 10 and OWASP API Security Top 10.
• Experience integrating security controls into CI/CD pipelines.
• Familiarity with cloud-native platforms such as Microsoft Azure, AWS or Google Cloud.
• Understanding of secure software development lifecycle and DevSecOps principles.
• Experience conducting vulnerability assessments and coordinating security remediation.
• Strong technical troubleshooting, analytical and documentation skills.

Technical Skills and Competencies

Microservices and Application Security

• Microservices architecture and distributed systems
• Secure application architecture
• Microservices threat modelling
• Service-to-service authentication and authorisation
• Zero Trust application security
• Secure software development lifecycle
• Application vulnerability assessments
• Secure coding principles
• OWASP Top 10
• OWASP API Security Top 10

API Security Technologies

• RESTful API security
• GraphQL API security
• OAuth 2.0
• OpenID Connect (OIDC)
• JSON Web Tokens (JWT)
• Mutual TLS (mTLS)
• API authentication and authorisation
• API gateways
• API rate limiting and request validation
• API vulnerability testing

Experience with platforms such as:

• Azure API Management
• AWS API Gateway
• Kong Gateway
• Apigee
• NGINX
• Other enterprise API management and security solutions

Container and Kubernetes Security

• Docker
• Kubernetes
• Kubernetes RBAC
• Kubernetes Network Policies
• Container image scanning
• Container runtime security
• Kubernetes secrets management
• Kubernetes security hardening
• Admission controllers and policy enforcement
• Container registry security

Experience with tools such as:

• Trivy
• Aqua Security
• Prisma Cloud
• Sysdig
• Falco
• Kubescape
• Other container and Kubernetes security platforms

DevSecOps and Application Security Testing

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA)
• Infrastructure as Code security scanning
• CI/CD pipeline security
• Software supply chain security
• Dependency vulnerability management
• Secrets scanning
• Automated security testing
• Security policy enforcement

Experience with tools such as:

• SonarQube
• Checkmarx
• Fortify
• Snyk
• Veracode
• OWASP ZAP
• Burp Suite
• GitHub Advanced Security
• GitLab Security

Cloud-Native Security

• Microsoft Azure
• Amazon Web Services (AWS)
• Google Cloud Platform (GCP)
• Azure Kubernetes Service (AKS)
• Amazon Elastic Kubernetes Service (EKS)
• Google Kubernetes Engine (GKE)
• Cloud IAM and workload identity
• Cloud-native network security
• Secrets and key management
• Cloud workload protection

Service Mesh and Secure Communications

• Istio
• Linkerd
• Envoy
• Service mesh security
• Mutual TLS
• Service identity
• Traffic encryption
• Service-to-service authorisation
• Secure ingress and egress controls
• Network segmentation

Automation and Infrastructure as Code

• Terraform
• Kubernetes YAML
• Helm
• Dockerfiles
• GitHub Actions
• GitLab CI/CD
• Jenkins
• Azure DevOps
• Python
• Bash
• PowerShell
• Security automation and configuration validation

Security Monitoring and Incident Response

• Application security logging
• Kubernetes audit logging
• Cloud-native threat detection
• SIEM integration
• Container runtime monitoring
• API security monitoring
• Vulnerability management
• Security incident investigation
• Threat detection and remediation

Security Frameworks and Standards

• OWASP Top 10
• OWASP API Security Top 10
• OWASP Application Security Verification Standard (ASVS)
• NIST Secure Software Development Framework (SSDF)
• NIST Cybersecurity Framework
• ISO/IEC 27001
• CIS Kubernetes Benchmark
• Zero Trust security architecture
• Cloud-native security best practices

Relevant Certifications (Advantageous)

One or more of the following certifications would be beneficial:

• Certified Kubernetes Security Specialist (CKS)
• Certified Kubernetes Administrator (CKA)
• Certified Kubernetes Application Developer (CKAD)
• Certified Cloud Security Professional (CCSP)
• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• CompTIA Security+
• Microsoft Certified: Azure Security Engineer Associate
• AWS Certified Security - Specialty
• Google Cloud Professional Cloud Security Engineer
• Relevant DevSecOps, application security or cloud-native security certifications

Key Personal Attributes

• Strong analytical and technical problem-solving abilities.
• Excellent understanding of modern application security threats.
• Strong attention to detail and security awareness.
• Ability to identify and remediate complex microservices security vulnerabilities.
• Proactive approach to secure application development and infrastructure protection.
• Excellent communication and stakeholder engagement skills.
• Ability to collaborate effectively with development, DevOps, cloud and cybersecurity teams.
• Strong organisational and technical documentation skills.
• Ability to manage multiple security priorities and technical projects.
• High levels of confidentiality, accountability and professional integrity.