DevSecOps Engineer II

Responsibilities

• Perform continuous security posture assessments across AWS, Azure and GCP environments and identify cloud misconfigurations, insecure configurations and deviations from security baselines. 

• Conduct IAM and SSO access reviews, covering users, roles, groups, service accounts/service principals, permissions, access keys and privileged access, and identify excessive or stale access. 

• Identify and assess publicly exposed cloud resources, insecure network configurations and unnecessary external exposure across compute, storage, databases, load balancers and other cloud services. 

• Integrate security controls into CI/CD pipelines, including SAST, SCA, secrets scanning, Infrastructure-as-Code scanning, container/image scanning, DAST and software supply-chain controls. 

• Perform Infrastructure-as-Code security reviews and support secure implementation of Terraform and similar technologies. 

• Perform Kubernetes and container security assessments, including cluster configurations, Kubernetes RBAC, workload security, image security, hardening and security posture management. 

• Analyse vulnerabilities and security findings, validate risks and false positives, prioritise remediation and work with Engineering/SRE/DevOps teams to drive findings through closure. 

• Develop security automation using Python, Bash, cloud APIs and CLIs for IAM reviews, asset inventories, security assessments, compliance checks, monitoring, reporting and evidence collection. 

• Review cloud network and edge security controls including VPC/VNet, Security Groups/firewalls, load balancers, WAF, TLS/mTLS and public/private connectivity. 

• Monitor and review CloudSEK alerts and findings, perform initial analysis and validation, and coordinate remediation or escalation with relevant stakeholders. 

• Support CloudSEK block-rule activities, including review and validation of relevant indicators, domains and URLs, and coordinate appropriate blocking actions with responsible teams. 

• Support investigation of cloud and security alerts, exposed credentials, suspicious access, provider security notifications and other security events. 

• Participate in cloud architecture and design security reviews and provide practical security recommendations based on risk, secure-by-design and least-privilege principles. 

• Support security and audit requirements aligned with frameworks such as CIS, NIST, PCI DSS, ISO 27001 and OWASP. 

• Develop and maintain security standards, SOPs, hardening guidelines, assessment methodologies, technical documentation and operational runbooks. 

• Continuously identify opportunities to automate preventive and detective security controls and improve overall Cloud Security and DevSecOps maturity. 

• Participate in broader Information Security activities including vulnerability management, security assessments, incident investigations, security reviews, audit/compliance.

Skills

To be successful in this role, you should have: 

• Strong hands-on understanding of at least one major public cloud platform, preferably AWS, with working knowledge of Azure and/or GCP being an advantage. 

• Good understanding of cloud security across IAM, compute, storage, networking, encryption, logging and monitoring. 

• Knowledge of cloud security services such as AWS IAM/IAM Identity Center, Security Hub, AWS Config, CloudTrail, KMS and EKS, or equivalent services in Azure/GCP. 

• Hands-on understanding of CI/CD and DevSecOps security, including SAST, SCA, DAST, secrets scanning, IaC scanning and container/image security. 

• Experience with CI/CD technologies such as Jenkins, GitHub Actions, ArgoCD, Bitbucket Pipelines or equivalent platforms. 

• Working knowledge of Terraform and Infrastructure-as-Code security. 

• Good understanding of Docker, Kubernetes, Kubernetes RBAC, container security and cluster hardening. 

• Experience with scripting and automation using Python, Bash or similar languages. 

• Strong understanding of IAM, least privilege, MFA, privileged access, credential management and access governance. 

• Understanding of CSPM, KSPM, CWPP and CNAPP concepts. 

• Knowledge of cloud/network security concepts including VPC/VNet, Security Groups, firewalls, WAF, TLS/mTLS and private/public connectivity. 

• Experience with security monitoring, alert triage and threat/exposure-management platforms such as CloudSEK or equivalent solutions. 

• Exposure to security tooling such as Snyk or equivalent SAST/SCA, CSPM, container and infrastructure security solutions. 

• Understanding of vulnerability management, risk-based remediation and security incident investigation. 

• Knowledge of security standards and frameworks including CIS Benchmarks, NIST, PCI DSS, ISO 27001 and OWASP. 

• Ability to independently analyse security findings, document security risks and provide clear and practical remediation recommendations to technical stakeholders. 

Experience and Qualifications

• 3–6 years of relevant experience in Cloud Security, DevSecOps, Infrastructure Security, Platform Security or related security engineering roles. 

• Strong hands-on technical experience in cloud security, infrastructure security, vulnerability management and security automation. 

• Bachelor's degree in Computer Science, Information Technology, Cyber Security, Engineering or a related discipline, or equivalent relevant industry experience. 

• Relevant cloud/security certifications such as AWS Certified Security – Specialty, AWS Solutions Architect, Certified Kubernetes Security Specialist (CKS), Microsoft Azure Security Engineer, Google Professional Cloud Security Engineer or equivalent are an added advantage.