Senior Executive, DevSecOps Engineering

The
role will establish measurable security guardrails, secure
engineering standards, vulnerability-management workflows, software supply-chain
protections, and auditable release governance for a 24x7 mission-critical
environment. The incumbent will lead threat-modelling activities, maintain
security requirements and control evidence, support security incidents, mentor
engineering teams on remediation, and continuously improve controls using
findings from testing, production monitoring, incidents, and audits.

• Security Requirements
  & Threat Modelling: Define security and privacy requirements during
  planning and architecture; facilitate threat modelling, abuse-case analysis,
  and risk reviews before implementation.
  
• Secure Coding & Developer Guardrails: Establish secure
  coding standards, reusable pipeline templates, approved components, branch
  protections, peer-review controls, pre-commit checks, and developer guidance
  aligned with OWASP practices.
  
• Automated Application Security Testing: Integrate and tune
  SAST, DAST, SCA, secrets detection, API security testing, container scanning,
  and infrastructure-as-code scanning to provide fast, actionable feedback.
  
• Risk-Based Pipeline Gates: Implement severity,
  exploitability, asset-criticality, and compliance-based thresholds that block
  unacceptable risk while allowing documented, time-bound exceptions with
  accountable approval.
  
• Software Supply-Chain Security: Secure source,
  runners, build systems, dependencies, artifacts, registries, and deployment
  workflows using least privilege, isolated builds, SBOMs, provenance, signing,
  integrity verification, and trusted repositories.
  
• Vulnerability Remediation & Assurance: Triage findings,
  remove false positives, assess business impact, assign owners, track
  remediation service levels, verify fixes, manage risk acceptance, and report
  overdue exposure.
  
• Cloud, Container & IaC Security: Apply secure
  baselines and policy-as-code to AWS, Terraform, Ansible, CloudFormation,
  Docker, serverless services, IAM, networks, encryption, data services, and
  cloud configurations.
  
• Secrets, Identity & Access: Prevent credentials
  in code and pipelines; implement managed secrets, rotation, workload identity,
  short-lived credentials, role-based access, privileged access controls, and
  segregation of duties.
  
• Secure Release & Deployment: Maintain traceable
  approvals, immutable artifacts, controlled environment promotion, deployment
  verification, rollback readiness, and release evidence for production changes.
  
• Runtime Security & Feedback Loops: Improve security
  logging, detection, alerting, workload monitoring, incident playbooks, and
  forensic readiness; feed production findings, incidents, and penetration-test
  results back into backlog and pipeline controls.
  
• Governance, Metrics & Enablement: Translate internal
  standards and applicable requirements, including BNM RMiT, into automated
  controls and audit evidence; track control coverage, mean time to remediate,
  defect escape rate, exception ageing, and recurring root causes while coaching
  engineering teams.
  
  
  

Requirements

• Bachelor’s degree in
  Computer Science, Cybersecurity, Information Technology, Engineering, or a
  related field.
  
• Hands-on knowledge of secure SDLC practices, threat modelling, secure
  coding principles, and risk-based security gates.
  
• Practical experience integrating SAST, DAST, SCA, secrets scanning,
  container scanning, API testing, and IaC scanning into CI/CD workflows.
  
• Strong knowledge of AWS security services, IAM, SSO, encryption, key
  management, logging, network controls, and cloud security posture management.
  
• Experience securing Terraform, Ansible, CloudFormation, Docker,
  serverless architectures, artifact repositories, and deployment automation.
  
• Understanding of vulnerability management, CVSS and exploitability
  context, dependency risk, SBOMs, software provenance, and remediation
  governance.
  
• Knowledge of security and compliance frameworks relevant to regulated
  environments, such as BNM RMiT, ISO/IEC 27001, NIST CSF, CIS Benchmarks, and
  OWASP guidance.
  
• Proficiency with
  GitLab, Bitbucket, or GitHub, including protected branches, code review
  controls, runner security, pipeline orchestration, artifact governance, and
  auditable release approvals.
  
• 3+ years of hands-on
  experience in DevSecOps, application security, cloud security, platform
  engineering, or secure CI/CD delivery across hybrid environments.
  
• Demonstrated experience embedding automated security testing and policy
  checks into build, test, release, and deployment pipelines without creating
  unnecessary delivery friction.
  
• Practical experience securing AWS services, identities, networks,
  containers, serverless workloads, and infrastructure-as-code.
  
• Experience triaging vulnerabilities, coordinating remediation, managing
  risk exceptions, and producing evidence for security reviews and audits.
  
• Exposure to security monitoring, SIEM integration, incident response,
  detection engineering, and observability within 24x7 operational environments.
  
• Proven ability to collaborate with developers, security, risk,
  compliance, infrastructure, and operations teams and to communicate security
  findings with clear, actionable remediation guidance.
  

• DevSecOps Automation: Proficiency in Python, Bash, or PowerShell and in automating
  repeatable security controls and evidence collection.
  
• Application & Pipeline Security: Strong capability in SAST, DAST, SCA, secrets detection, API testing,
  security gates, and secure build and release design.
  
• Cloud-Native Security: Working knowledge
  of cloud, IAM, containers, serverless, infrastructure-as-code, encryption, and
  policy-as-code security.
  
• Risk, Compliance & Governance: Ability to convert regulatory and security requirements into
  proportionate, traceable, and measurable engineering controls.
  
• Collaboration & Security Enablement: Skilled in partnering with engineering teams, explaining risk in
  practical terms, documenting standards, and promoting a security-by-design
  culture.