Key Responsibilities:

• Integrate security practices into development and operations processes to create a secure and efficient CI/CD pipeline
• Automate security processes throughout all stages of the software development lifecycle (SDLC)
• Develop and maintain tools and scripts for security task automation, including static and dynamic application security testing (SAST/DAST), infrastructure vulnerability analysis, secrets management, and compliance-as-code
• Participate in designing and implementing secure infrastructure for on-premise solutions
• Configure and maintain security monitoring and incident response systems
• Conduct vulnerability assessments and participate in remediation processes
• Develop and implement security policies and procedures for DevOps teams
• Train and advise development and operations teams on security matters
• Participate in selecting and implementing security tools
• Ensure compliance with security requirements and regulatory standards
• Monitor and analyze security logs
• Participate in security incident investigations
• Continuously study new security threats and DevSecOps best practices

Requirements:

• Proven experience as a DevSecOps Engineer, Security Engineer, or DevOps Engineer with a security focus (3+ years)
• Deep understanding of DevOps and DevSecOps principles
• Experience with CI/CD tools (GitLab CI)
• Practical experience with static and dynamic code security analysis tools (SAST/DAST)
• Experience with infrastructure vulnerability analysis tools (Nessus, OpenVAS)
• Knowledge of principles and experience with secrets management systems (HashiCorp Vault)
• Experience with security monitoring systems and SIEM (Splunk)
• Knowledge of network security principles (firewalls, WAF, IDS/IPS)
• Experience with containerization systems (Docker, Kubernetes/OpenShift) and their security
• Knowledge of scripting languages (Python, Bash, PowerShell)
• Understanding of Infrastructure as Code (IaC) principles and experience with relevant tools (Terraform, Ansible)
• Knowledge of key security standards and practices (OWASP Top 10, CIS Benchmarks)
• Experience with version control systems (Git)
• Ability to automate routine tasks
• Strong diagnostic and problem-solving skills
• Ability to effectively interact with development and operations teams
• Proactivity, responsibility, and commitment to continuous development in security

Required language skills:

• Knowledge of Russian and English at a level sufficient for professional communication (written and oral) with clients and developers

Desired skills:

• Experience with security tools for .NET applications
• Experience conducting penetration tests (as an advantage)
• Relevant security certifications (Certified Kubernetes Security Specialist (CKS), CISSP, CEH, OSCP)

Interested candidates are kindly requested to send their resumes to the e-mail address in the Apply for job button with the subject line "DevSecOps Engineer".