DevSecOps Engineer

We are looking for an experienced DevSecOps Engineer to review product security, support secure architecture, conduct vulnerability assessments, and address enterprise information security requirements. The role requires hands-on expertise in application security, API security, secure development, automated security testing, and infrastructure protection.

Key Responsibilities:

• Conduct secure code reviews for Python and FastAPI applications.
• Identify and remediate vulnerabilities based on the OWASP Top 10.
• Review file-upload security and PDF related threats, including malicious files, embedded scripts, parser exploits, and path traversal.
• Assess authentication and session security using OAuth 2.0, OIDC, SAML, JWT, and secure token lifecycle practices.
• Review authorisation controls, including RBAC, least privilege, privilege escalation, and IDOR prevention.
• Identify injection risks such as SQL injection, command injection, SSRF, and path traversal.
• Review API security controls, including rate limiting, mass assignment, input validation, and sensitive error leakage.
• Review cryptographic controls, including TLS, encryption at rest, key management, secure primitives, mTLS, and certificate management.
• Perform DAST using OWASP ZAP or Burp Suite.
• Implement SAST using Semgrep, Bandit, or CodeQL.
• Manage dependency and software-composition scanning using Dependabot, Snyk, pip-audit, and SBOM tools.
• Implement secret scanning using gitleaks or TruffleHog, including exposed-secret and Git-history remediation.
• Support secrets management, host security, container security, and runtime hardening.
• Integrate security controls into CI/CD pipelines.
• Review backup security and ensure restore procedures are regularly tested.
• Document vulnerabilities, recommend remediation, and support enterprise security reviews and audits.

Required Skills:

• 2+ years of experience in DevSecOps, Application Security, Product Security, or Information Security.
• Strong understanding of secure coding, OWASP vulnerabilities, and REST API security.
• Hands-on experience with Python, FastAPI, SAST, DAST, SCA, secret scanning, and vulnerability management.
• Strong knowledge of authentication, authorisation, RBAC, OAuth 2.0, OIDC, SAML, and JWT.
• Experience with TLS, encryption, key management, mTLS, certificates, Docker, host security, and CI/CD security.
• Strong analytical, documentation, communication, and stakeholder-management skills.

Timings: Morning Shift
Job type: Full time (Onsite)
Location: MACHS, Karachi

Pay: Rs280,000.00 - Rs300,000.00 per month

Application Question(s):

• Are you comfortable working onsite?
• Are you comfortable commuting to our office location?

Location:

• Karachi (Required)

Work Location: In person