DevSecOps Engineer

The candidate will have responsibilities across the following functions:

Vulnerability Management:

• Own the end-to-end vulnerability lifecycle for a given Business Unit consisting of multiple enterprise-level products. (SaaS and on-prem).
• Triage, track, correlate, and remediate vulnerabilities from tools like Black Duck, Prisma Cloud, Qualys, JFrog Xray, etc.
• Understanding how these tools work and mapping in a common tool.
• Co-ordinate with business security leads to plan patching strategies and risk mitigation.

Security Automation:

• Integrate security scanning tools into common tools.
• In progress and SLA tracking for all the vulnerabilities and work closely with respective business units.
• Develop dashboards and reports for compliance and leadership visibility.
• Write high-level designs to automate some of the manual work.

Collaboration and Governance:

• Work cross-functionally with product teams and stakeholders.
• Contribute to security policies, standards, and best practices.
• Participate in incident response and post-mortem analysis.

Education and Awareness:

• Publish security advisories on high-priority vulnerabilities (CVEs).
• Help junior team members with security aspects.
• Kubernetes, container build pipeline, and repository platform knowledge is a plus.
• Familiarity with vulnerability scoring models like CVSS, EPSS, and BDSA.

Key Technologies:

• Security Tools: Black Duck, Prisma Cloud, Qualys, Snyk, Coverity, SonarQube, Burp Suite.
• DevOps Stack: Jenkins, Kubernetes, Helm, Docker.
• Programming: Python, Shell, YAML, JSON (Good to have).
• Cloud Platforms: AWS, GCP (Understanding the basics of the cloud).