Senior Executive, DevSecOps Engineering

ROLE OVERVIEW

The Senior Executive, DevSecOps Engineering will own and embed security controls across the end-to-end software development lifecycle (SDLC)—requirements, architecture, coding, build, test, release, deployment, and operations. The role will engineer secure-by-default CI/CD pipelines, automate risk-based security gates, and provide developers with timely, actionable feedback so vulnerabilities are prevented or remediated before production. Working across engineering, cloud, infrastructure, cybersecurity, risk, and compliance teams, the incumbent will reduce application, platform, and software supply-chain risk across hybrid environments, primarily AWS.

The role will establish measurable security guardrails, secure engineering standards, vulnerability-management workflows, software supply-chain protections, and auditable release governance for a 24x7 mission-critical environment. The incumbent will lead threat-modelling activities, maintain security requirements and control evidence, support security incidents, mentor engineering teams on remediation, and continuously improve controls using findings from testing, production monitoring, incidents, and audits.

KEY RESPONSIBILITIES

• Security Requirements & Threat Modelling: Define security and privacy requirements during planning and architecture; facilitate threat modelling, abuse-case analysis, and risk reviews before implementation.
• Secure Coding & Developer Guardrails: Establish secure coding standards, reusable pipeline templates, approved components, branch protections, peer-review controls, pre-commit checks, and developer guidance aligned with OWASP practices.
• Automated Application Security Testing: Integrate and tune SAST, DAST, SCA, secrets detection, API security testing, container scanning, and infrastructure-as-code scanning to provide fast, actionable feedback.
• Risk-Based Pipeline Gates: Implement severity, exploitability, asset-criticality, and compliance-based thresholds that block unacceptable risk while allowing documented, time-bound exceptions with accountable approval.
• Software Supply-Chain Security: Secure source, runners, build systems, dependencies, artifacts, registries, and deployment workflows using least privilege, isolated builds, SBOMs, provenance, signing, integrity verification, and trusted repositories.
• Vulnerability Remediation & Assurance: Triage findings, remove false positives, assess business impact, assign owners, track remediation service levels, verify fixes, manage risk acceptance, and report overdue exposure.
• Cloud, Container & IaC Security: Apply secure baselines and policy-as-code to AWS, Terraform, Ansible, CloudFormation, Docker, serverless services, IAM, networks, encryption, data services, and cloud configurations.
• Secrets, Identity & Access: Prevent credentials in code and pipelines; implement managed secrets, rotation, workload identity, short-lived credentials, role-based access, privileged access controls, and segregation of duties.
• Secure Release & Deployment: Maintain traceable approvals, immutable artifacts, controlled environment promotion, deployment verification, rollback readiness, and release evidence for production changes.
• Runtime Security & Feedback Loops: Improve security logging, detection, alerting, workload monitoring, incident playbooks, and forensic readiness; feed production findings, incidents, and penetration-test results back into backlog and pipeline controls.
• Governance, Metrics & Enablement: Translate internal standards and applicable requirements, including BNM RMiT, into automated controls and audit evidence; track control coverage, mean time to remediate, defect escape rate, exception ageing, and recurring root causes while coaching engineering teams.

WHAT DOES IT TAKE TO BE SUCCESSFUL

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related field.
• Hands-on knowledge of secure SDLC practices, threat modelling, secure coding principles, and risk-based security gates.
• Practical experience integrating SAST, DAST, SCA, secrets scanning, container scanning, API testing, and IaC scanning into CI/CD workflows.
• Strong knowledge of AWS security services, IAM, SSO, encryption, key management, logging, network controls, and cloud security posture management.
• Experience securing Terraform, Ansible, CloudFormation, Docker, serverless architectures, artifact repositories, and deployment automation.
• Understanding of vulnerability management, CVSS and exploitability context, dependency risk, SBOMs, software provenance, and remediation governance.
• Knowledge of security and compliance frameworks relevant to regulated environments, such as BNM RMiT, ISO/IEC 27001, NIST CSF, CIS Benchmarks, and OWASP guidance.
• Proficiency with GitLab, Bitbucket, or GitHub, including protected branches, code review controls, runner security, pipeline orchestration, artifact governance, and auditable release approvals.

Work Experience

• 3+ years of hands-on experience in DevSecOps, application security, cloud security, platform engineering, or secure CI/CD delivery across hybrid environments.
• Demonstrated experience embedding automated security testing and policy checks into build, test, release, and deployment pipelines without creating unnecessary delivery friction.
• Practical experience securing AWS services, identities, networks, containers, serverless workloads, and infrastructure-as-code.
• Experience triaging vulnerabilities, coordinating remediation, managing risk exceptions, and producing evidence for security reviews and audits.
• Exposure to security monitoring, SIEM integration, incident response, detection engineering, and observability within 24x7 operational environments.
• Proven ability to collaborate with developers, security, risk, compliance, infrastructure, and operations teams and to communicate security findings with clear, actionable remediation guidance.

Skills & Competencies

• DevSecOps Automation: Proficiency in Python, Bash, or PowerShell and in automating repeatable security controls and evidence collection.
• Application & Pipeline Security: Strong capability in SAST, DAST, SCA, secrets detection, API testing, security gates, and secure build and release design.
• Cloud-Native Security: Working knowledge of cloud, IAM, containers, serverless, infrastructure-as-code, encryption, and policy-as-code security.
• Risk, Compliance & Governance: Ability to convert regulatory and security requirements into proportionate, traceable, and measurable engineering controls.
• Collaboration & Security Enablement: Skilled in partnering with engineering teams, explaining risk in practical terms, documenting standards, and promoting a security-by-design culture.