Infrastructure Security Engineer/DevSecOps

Information Security Team:

We are seeking a highly motivated and experienced DevSecOps Engineer to join our Network & Infrastructure Security team. In this role, you will be focusing on integrating security best practices throughout the entire software development lifecycle (SDLC) for our cloud-native applications and infrastructure. You will work closely with development, infrastructure and security teams to automate security controls and proactively identify and mitigate risks within our AWS and Kubernetes environments. Your expertise will be vital in building secure, scalable, and resilient systems.

Challenges that await you:

• Security Automation & Integration: Design, implement, and maintain automated security controls and pipelines (CI/CD) within GitLab. This includes static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), infrastructure as code (IaC) scanning, and container image scanning.
• Cloud Security (AWS): Implement and enforce security best practices for AWS services, including IAM, VPC, Security Groups, S3, EC2, Lambda, EKS, and other relevant cloud components.
• Kubernetes Security: Secure Kubernetes clusters and workloads, pod security policies, container runtime security, admission controllers, secrets management, and vulnerability scanning of container images.
• Service Mesh Security (Istio or similar): Implement and manage security features within a service mesh (e.g., Istio) for traffic encryption, authentication, authorization, and policy enforcement between microservices.
• Incident Response & Remediation: Implement monitoring rules to detect infrastructure related security incidents and response measures.
• Threat Modeling & Risk Assessment: Participate in threat modeling exercises and risk assessments for new features and infrastructure changes, providing security recommendations.
• Security Tooling & Research: Evaluate, recommend, and implement new security tools and technologies to enhance our security posture. Stay abreast of emerging security threats, vulnerabilities, and technologies in the cloud-native landscape.
• Collaboration & Education: Act as a security advocate, providing guidance and training to development and operations teams on secure coding practices, infrastructure security, and DevSecOps principles.

What makes you a great fit:

• 1+ years of experience in DevSecOps, Cloud Security, or a related cybersecurity role, with a strong focus on automation and infrastructure security.
• Extensive experience with AWS(Azure/GCP): Understanding of AWS/Azure/GCP security services, best practices, and architecture.
• Proficiency in Kubernetes: Strong knowledge of Kubernetes architecture, security configurations, and deploying secure workloads.
• CI/CD Pipeline Expertise: Hands-on experience designing, implementing, and securing CI/CD pipelines, preferably with GitLab CI/CD.
• Infrastructure as Code (IaC): Hands-on experience with IaC tools like Terraform or CloudFormation for secure infrastructure provisioning and management.
• Service Mesh Knowledge: Experience with Istio or a similar service mesh for securing inter-service communication.
• Networking Fundamentals: Understanding of network protocols, firewalls, VPNs, and network segmentation in cloud environments.