DevOps Engineer

DevSecOps Engineer

ABOUT SHESHI

Bringing Sanctity to Numbers

Sheshi is a Financial Operating System — the governed infrastructure layer that converts raw financial data into results that organisations can completely trust. Governed, auditable, period-locked, and traceable to the source.

We are headquartered in Bangalore, building an enterprise-grade product for the global market.

Security cannot be an afterthought in a platform that governs financial data. As DevSecOps Engineer, you embed security into every stage of how Sheshi builds and ships software — from the first line of code to what runs in production. You make secure practice automatic, not an extra step engineers have to remember.

WHY SHESHI

What Makes This Role Worth Doing

Security with real stakes. You are securing a platform that governs enterprise financial data — the work has genuine weight.

Build the practice from scratch. You define how security gets embedded into Sheshi's engineering lifecycle from the ground up.

A path toward enterprise certification. You will drive Sheshi's readiness for SOC 2, ISO 27001, or equivalent — work that directly unlocks larger enterprise deals.

Partnership, not isolation. You work closely with engineering and the SRE function, embedded in how the platform is built.

Continuous Validation & Periodic Audits: Establish a recurring VAPT cadence to identify and evaluate security flaws in the system.

RESPONSIBILITIES

What You Will Own

Secure CI/CD

• Own security integration across the CI/CD pipeline — static and dynamic analysis, dependency scanning, and secrets detection.
• Ensure no code reaches production without passing defined security checks.

Vulnerability and Risk Management

• Own vulnerability management across applications and infrastructure — scanning, tracking, and driving remediation.
• Run regular security assessments and coordinate penetration testing as the platform matures.

Application and Infrastructure Security

• Embed secure coding practices into the development lifecycle — OWASP alignment, secure API design, and input validation standards.
• Own infrastructure security configuration in partnership with the SRE function — access control, encryption, and secrets management.

Compliance and Security Culture

• Drive readiness for enterprise security certifications — SOC 2, ISO 27001, or equivalent — as the platform scales.
• Own audit logging and traceability standards that support governance and customer compliance needs.
• Provide security guidance to engineering teams as part of everyday development, not a separate compliance exercise.

WHAT WE ARE LOOKING FOR

Your Background and Strengths

Experience

• 4-8 years in DevSecOps, application security, or security engineering roles.
• Proven experience embedding security into CI/CD pipelines for a SaaS product.
• Track record of driving vulnerability management and remediation at pace.

Technical Depth

• Strong understanding of OWASP practices, secure coding principles, and common vulnerability classes.
• Hands-on experience with security tooling — SAST, DAST, dependency scanning, and secrets detection.
• Working knowledge of AWS security services — IAM, KMS, Security Hub, GuardDuty, or equivalent.
• Familiarity with compliance frameworks — SOC 2, ISO 27001 — and what they require operationally.
• Scripting proficiency in Python, Bash, or similar for security automation.

How You Work

• You build security into the pipeline, so it becomes automatic, not something teams remember to do.
• You communicate risk clearly to both technical and non-technical stakeholders.
• You balance security rigour with development speed, treating them as complementary, not opposing.
• You stay current on emerging threats and bring that awareness back into how Sheshi builds.

Nice to Have

• Experience in a regulated, financial, or compliance-sensitive SaaS environment.
• Direct experience achieving SOC 2 or ISO 27001 certification for a growing SaaS company.
• Familiarity with Node.js and React application security considerations.