DevSecOps & Application Security Engineer

Job Title: DevSecOps & Application Security Engineer

HIRING MANAGER Expectations:

Strong experience in DevSecOps, Terraform, Infrastructure as Code (IaC), AWS/Azure Security, GitHub Advanced Security, and Veracode. Experience implementing security controls across the SDLC and CI/CD pipelines. Hands-on exposure to CyberArk PAM, PKI, code reviews, and application security practices. Knowledge of policy-as-code and supply chain security concepts is preferred.

Job Description:

DevSecOps & Application Security Engineer

Role Summary:

Experienced security practitioner focused on DevSecOps, application security, and cloud security architecture, supporting a banking/financial services client’s secure SDLC, infrastructure-as-code, supply-chain security, and privileged access / PKI controls.

Key Responsibilities:

Design, develop, and review Terraform (IaC) with a security-first approach; perform IaC code reviews Architect and implement deep technical security controls across AWS and Microsoft (Azure / Microsoft security) environments Embed application security practices across design and delivery Implement policy-as-code enforcement across the SDLC — PR-time, pipeline-time, deploy-time, and runtime Drive supply-chain security: signed builds (Sigstore/cosign), SBOM generation, SLSA-aligned provenance, dependency pinning, runner isolation Set up and operationalize Veracode and/or GitHub Advanced Security Deploy and support CyberArk PAM and PKI Contribute to security runbooks, pipeline standards, and process documentation Support audit and compliance evidence gathering Escalate and coordinate on critical security events with senior leadership

Required Experience:

7+ years in cybersecurity operations/engineering, cloud security, or DevSecOps Hands-on Terraform coding and IaC code review experience Deep technical AWS and Microsoft security and architecture experience Application security experience

History of setting up Veracode and/or GitHub Advanced Security CyberArk PAM and PKI deployment experience BFSI or other regulated-industry experience preferred

Core Technical Expertise:

Terraform / infrastructure-as-code security and code review AWS security architecture; Microsoft Azure / Microsoft security architecture DevSecOps toolchains and secure SDLC integration Application security (SAST/DAST/SCA in practice) Policy-as-code across PR, pipeline, deploy, and runtime Supply-chain security: Sigstore/cosign, SBOM, SLSA-aligned provenance, dependency pinning, runner isolation CyberArk PAM (deployment); PKI (deployment) Veracode and/or GitHub Advanced Security

Preferred Certifications AWS Certified Security – Specialty; Microsoft security/architecture certifications (e.g., AZ-500, SC-100, or equivalent) as applicable