Senior DevSecOps Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior DevSecOps Engineer based in India. The Senior DevSecOps Engineer will play a critical role in integrating security into software development and deployment processes, ensuring that security is embedded throughout the engineering lifecycle rather than treated as a final checkpoint. You will design and maintain secure CI/CD pipelines, strengthen build environments, and implement automated security controls across cloud infrastructure and application delivery workflows. Working closely with research and development (R&D), IT security, and compliance teams, you will help engineers identify and resolve vulnerabilities without compromising delivery speed. You will also oversee infrastructure-as-code security, container protection, and automated testing practices to improve the organization's overall security posture. This remote opportunity is ideal for an experienced technical professional who combines hands-on DevOps expertise with a strong security mindset. You will contribute to secure, reliable, and compliant technology operations within a highly regulated healthcare environment.

Secure CI/CD Pipeline Engineering: Design, implement, maintain, and continuously improve secure CI/CD pipelines, embedding security controls throughout the software development lifecycle, from code commits to production deployment. Automated Security Testing: Integrate and manage static application security testing (SAST), dynamic application security testing (DAST), dependency scanning, container scanning, and secrets management tools to detect and address vulnerabilities early. Build and Deployment Security: Harden build systems, artifact repositories, deployment tooling, and related infrastructure against common attack vectors, ensuring the integrity and security of software delivery processes. Infrastructure-as-Code Security: Review and improve infrastructure-as-code configurations, including Terraform, Kubernetes, and cloud resources, to enforce secure configuration standards and reduce infrastructure risks. Cloud and Container Security: Strengthen security controls across cloud environments and containerized workloads, applying best practices to Docker, Kubernetes, and relevant cloud-native services. Engineering Partnership: Serve as a security partner to R&D teams, helping developers understand vulnerabilities, prioritize remediation, and make informed security decisions without unnecessarily slowing development. Security Automation and Guardrails: Develop automated security checks, reusable tooling, and preventive controls that make secure engineering practices easier to adopt and integrate naturally into developer workflows. Architecture and Tool Assessment: Evaluate new tools, services, and technical architecture decisions for security implications, recommending appropriate safeguards before implementation or release. Compliance Alignment: Collaborate with IT security and compliance stakeholders to ensure that pipeline configurations, infrastructure changes, and software delivery practices align with applicable regulatory and security requirements. Incident Response Support: Assist with investigating and responding to security incidents involving build systems, deployment pipelines, cloud infrastructure, and production environments. Security Standards and Documentation: Establish, maintain, and communicate secure software development lifecycle standards, technical guidelines, and engineering best practices across teams. Requirements Professional Experience: Approximately 7–8 years of experience in DevOps, platform engineering, or security engineering, with substantial hands-on experience in infrastructure management and software delivery pipelines. CI/CD Security Expertise: Demonstrated experience securing CI/CD pipelines and build systems, including implementing preventive controls and integrating security throughout the software development lifecycle. Cloud Infrastructure Knowledge: Strong practical experience with at least one major cloud platform, such as AWS, Microsoft Azure, or Google Cloud Platform (GCP). Infrastructure-as-Code Skills: Experience securing and managing infrastructure through Terraform or comparable infrastructure-as-code technologies, with an understanding of configuration risks and secure deployment practices. Containerization and Orchestration: Working knowledge of Docker, Kubernetes, and container security principles, including vulnerability assessment and secure configuration management. Application Security Tooling: Hands-on experience with SAST and DAST solutions, dependency and container scanning, secrets management, and other tools used to identify and mitigate software supply chain risks. Security Automation: Ability to develop scripts, automation workflows, or custom tooling that improves security enforcement and reduces manual effort across engineering processes. Compliance Awareness: Familiarity with security and compliance frameworks such as HIPAA, SOC 2, HITRUST, or GDPR. Experience in healthcare, financial technology, or another regulated industry is an advantage. Technical Communication: Strong written and verbal communication skills, with the ability to explain vulnerabilities, security trade-offs, and remediation approaches clearly to engineering and non-security stakeholders. Independent Working Style: Ability to manage responsibilities independently, exercise sound technical judgment, and prioritize competing tasks effectively. Critical Thinking: Strong analytical and problem-solving skills, with the ability to identify potential attack paths, assess risks, and develop practical security solutions. Preferred Certifications: Relevant certifications, such as AWS, Azure, or GCP security credentials, Certified Kubernetes Security Specialist (CKS), or equivalent qualifications, are advantageous. Work Schedule: Ability to work remotely from India and accommodate the required Monday-to-Friday schedule of 5:30 p.m. to 2:30 a.m. India Standard Time (IST). Benefits Remote Work: Fully remote working arrangement from India. Annual Leave: 30 days of total leave per calendar year. Public Holidays: Annual public holidays in accordance with applicable policies. Healthcare Coverage: Medical insurance through a mediclaim policy. Lifestyle Rewards: Access to a lifestyle rewards program offering additional employee benefits. Financial Protection: Group term life insurance coverage. Retirement Benefits: Gratuity benefits in accordance with applicable policies and eligibility requirements. Professional Development: Opportunities to expand technical expertise in cloud security, DevSecOps, infrastructure automation, and secure software delivery. Collaborative Environment: Opportunity to work with engineering, IT security, and compliance professionals on meaningful security initiatives. Technical Impact: The chance to strengthen security practices across software development, cloud infrastructure, and production systems in a healthcare-focused technology environment.