DevSecOps Engineer

Job Purpose

To execute the tasks in securing the software development lifecycle within the banking environment through collaboration across teams to integrate security into CI/CD pipelines, secure containerized applications, and reduce risks while ensuring high quality and secure software delivery to defend against software supply chain attacks and set the standard for secure development practices.

Location

• Head Office, Phnom Penh (01 post)

Major Areas of Responsibility

• Implement the Secure SDLC program using tools like GitLab, SonarQube, JFrog, and related tools while ensuring integration of security practices across the development lifecycle.
• Design and maintain secure, highly available CI/CD pipelines with automation tools like Jenkins and Kubernetes, incorporating best practices for container security and ensure security of infrastructure as code (IaC).
• Analyze and work with development team resolve vulnerabilities, bugs, and code smells using SonarQube and follow industry standards such as OWASP Top 10, CWE Top 25.
• Guide developers on secure coding practices, including branching strategies, secure configurations, and leveraging SAST, DAST, and SCA tools and more.
• Support stakeholders, and coordinate with internal and external vendors to deliver secure solutions efficiently as well as provide guidance to the team, if required.
• Draft and refine procedures, guidelines, and remediation plans in discussion with the line manager to ensure compliance with organizational security policies and standards.

Qualifications

• Bachelor’s degree in Computer Science, Information Technology, or other relevant fields.
• Minimum three years of experience in Operations, Development, Security, or related fields.
• Certifications in CySA+, OSWA, or equivalent in cybersecurity or DevOps is preferred credentials.
• Experience with using DevOps Tools such as Jenkins, Kubernetes, Git, Docker, Ansible, and Microservices architecture.
• Proficiency in YAML, Bash, Python, or similar scripting languages.
• Proven ability to resolve technical challenges and implement secure, automated solutions.
• Familiarity with SAST, DAST, SCA tools, and OWASP Top 10 standards.
• Strong time management, and ability to work under pressure.
• Growth-oriented attribute with a commitment to confidentiality, integrity, and ethical practices.
• Ability to use and communicate in both Khmer and English.