DevSecOps Specialist is responsible for integrating security practices into the Software Development Life Cycle (SDLC), CI/CD pipelines, cloud infrastructure, and operational processes. This role ensures that security is embedded throughout the development lifecycle while enabling agile delivery and maintaining compliance with organizational and regulatory requirements.
The position collaborates closely with Development, Infrastructure, Cloud Engineering, Quality Assurance, Architecture, and Information Security teams to build secure, scalable, and resilient systems.
Responsibilities
DevSecOps Integration
- Design and implement DevSecOps practices across application development and infrastructure deployment processes.
- Embed security controls throughout the SDLC.
- Automate security testing and validation within CI/CD pipelines.
- Establish secure coding, security-by-design, and shift-left security practices.
CI/CD Security
Cloud & Infrastructure Security
Implement and maintain security controls across cloud platforms:
- AWS
- Microsoft Azure
- Google Cloud Platform (GCP)
Secure containerized environments:
- Docker
- Kubernetes
- OpenShift
Enforce infrastructure security through Infrastructure as Code (IaC):
- Terraform
- CloudFormation
- Ansible
Security Automation
Automate vulnerability assessment and remediation processes.
Develop scripts and automation solutions using:
Implement policy-as-code and compliance-as-code frameworks.
Vulnerability Management
Monitoring & Incident Response
- Support security monitoring and logging initiatives.
- Integrate security alerts into operational workflows.
- Participate in security incident investigations and post-incident reviews.
- Improve detection and response capabilities.
Compliance & Governance
Security Awareness
- Promote secure development practices among engineering teams.
- Conduct threat modeling and secure code review workshops.
- Provide technical guidance on security best practices.
Qualifications
Education
- Bachelor's degree in:
- Information Technology
- Computer Science
- Cybersecurity
- Software Engineering
- Related disciplines
- At least 5+ years of experience in DevSecOps, Cloud Security, or Security Engineering.
Technical Skills
DevOps Tools
- Git
- GitHub
- GitLab
- Bitbucket
- Jenkins
- Azure DevOps
Cloud Platforms
Container & Orchestration
- Docker
- Kubernetes
- OpenShift
Security Tools
- SonarQube
- Checkmarx
- Veracode
- Snyk
- Fortify
- Prisma Cloud
- Aqua Security
- Qualys
- Nessus
Infrastructure as Code
- Terraform
- CloudFormation
- Ansible
Programming/Scripting
- Python
- Bash
- PowerShell
- YAML
Security Knowledge
- Secure SDLC
- Threat Modeling
- Secure Coding Practices
- Zero Trust Architecture
- Identity and Access Management (IAM)
- Secrets Management
- Vulnerability Management
Preferred Certifications
Security Certifications
- CISSP
- CISM
- CEH
- CompTIA Security+
Cloud Security Certifications
- AWS Certified Security Specialty
- Microsoft Azure Security Engineer Associate (AZ-500)
- Google Professional Cloud Security Engineer
DevSecOps Certifications
- Practical DevSecOps Professional (PDSP)
- Certified DevSecOps Professional (CDP)
Kubernetes Certifications
- Certified Kubernetes Security Specialist (CKS)
- Certified Kubernetes Administrator (CKA)