DevSecOps Lead

General Responsibilities

The DevSecOps Lead is responsible for leading the integration of robust security practices into our DevOps pipeline, ensuring the protection and compliance of our cloud infrastructure. This role demands a strategic mindset to optimize system performance and reliability while fostering a culture of security within the organization.

Duties and Responsibilities

Cloud Infrastructure Management

• Lead the design, implementation, and management of scalable, secure, and resilient cloud infrastructure
• Monitor and optimize cloud resource usage and performance, making strategic improvement recommendations.

Security Integration

• Develop and implement advanced security practices within the DevOps lifecycle.
• Conduct regular security assessments, vulnerability scanning, and penetration testing.
• Implement and manage robust security controls, policies, and procedures.
• Continuous Integration/Continuous Deployment (CI/CD):
• Architect and maintain CI/CD pipelines to automate and secure deployment processes.
• Ensure integration of advanced security checks within the CI/CD pipelines.
• Compliance and Governance:
• Ensure adherence to industry regulations (e.g. GDPR, HIPAA, PCI-DSS) and internal compliance standards.
• Implement and manage comprehensive compliance monitoring tools and frameworks.
• Prepare and maintain detailed documentation for audits and compliance requirements.
• Monitoring and Incident Response:
• Implement and manage sophisticated monitoring tools for cloud infrastructure and applications.
• Develop and maintain incident response plans and procedures.
• Lead complex incident response activities, including root cause analysis and comprehensive remediation.

Collaboration and Leadership

• Foster a collaborative environment by working closely with development, operations, and security teams.
• Collaborate with cross-functional teams, including developers, operations, and security, to ensure seamless integration of security practices.
• Facilitate knowledge sharing, and provide training, mentorship, and guidance on DevSecOps principles and practices to team members.
• Communicate effectively with stakeholders to report on security posture, incidents, and strategic improvements.
• Other job-related activities that may be assigned from time to time.

• Deep expertise in Cloud services (EC2, S3, RDS, Lambda, IAM, VPC, Cloud

Formation, etc.).

• Proficiency in infrastructure as code (IaC) tools such as Terraform or Cloud

Formation.

• Extensive experience with CI/CD tools such as Jenkins, GitLab CI, or Code

Pipeline.

• Strong knowledge of advanced security best practices and frameworks (NIST, CIS, OWASP, etc.).
• Experience with advanced security tools such as, Guard

Duty, Inspector, and WAF.

• Proficiency in scripting languages such as Python, Bash, or PowerShell.
• Familiarity with containerization technologies (Docker, Kubernetes) and their security aspects.
• Strong understanding of networking and network security concepts.

Qualifications

• Had background in Architecture, Automation and security as a DevSecOps