Senior DevSecOps Engineer

About SM Investments

At SM Investments, we shape sustainable growth stories that move industries and uplift communities. As one of the Philippines’ leading conglomerates, we build opportunities across retail, banking, and property guided by excellence, integrity, and innovation.

Key Responsibilitie

• Automate security controls within CI/CD pipeline s (Jenkins, GitLab, CircleCI, GitHub Actions
• Secure cloud environments (AWS, Azure, GCP ) and container platforms (Docker, Kubernetes)
• Integrate security testing tools (SAST, DAST, SCA ) such as Snyk, SonarQube, Checkmarx, or Fortify
• Implement Infrastructure as Code (IaC) securit y using Terraform and CloudFormation
• Enforce IAM best practice s, RBAC, and federated identity (SAML, OAuth, Cognito)
• Apply security framework s (ISO 27001, NIST, CIS) and compliance automation
• Perform threat modeling, risk assessments, and vulnerability management
• Secure DevOps toolchains, artifact repositories (JFrog, Nexus), and source control system
• Implement Zero Trust principle s and cloud-native security controls
• Maintain audit trails, enforce policies (OPA, AWS Config), and ensure governance compliance

Technical Competencies

• Strong expertise i n DevSecOps practices and secure SDLC
• Deep knowledge o f cloud and container security
• Hands-on experience wit h IaC security and automation
• Familiarity wit h Kubernetes securi ty (RBAC, network policies, secrets management)
• Proficiency i n security tools and automation frameworks
• Experience wit h compliance-as-co de tools (Chef InSpec, OpenSCAP)

Preferred Experience

• Proven experience in DevSecOps within platform engineering environme nts, building secure and scalable developer platforms
• Hands-on expertise wi th Terraf orm, including securing Terraform modules, state management, and IaC pipelines
• Experience designing and securi ng internal developer platforms (ID Ps) or platform-as-a-service (PaaS) environments
• Strong background in automating security controls at sc ale across cloud-native architectures
• Experience wi th Cloud Security Posture Management (CS PM) tools such as Prisma Cloud or Dome9
• Exposure to enterprise-grade security architecture and governance framewo rks