What is the opportunity?

Zafin is seeking a detail-oriented and technically adept DevSecOps Engineer to join our Information Security Team. The candidate will play a key role in integrating security practices across the software development lifecycle, ensuring that security is considered at every stage, from development through to deployment and maintenance. The role requires close collaboration with both development and engineering teams to implement security measures, automate security processes, and respond to security incidents in cloud environments. The ideal candidate will have experience with DevOps practices, application security, and cloud security, with a strong focus on automation.

What will you do?

Infrastructure as Code (IaC) and Security Automation: Assist the relevant teams to Implement and maintain security configurations using Infrastructure as Code (IaC) in cloud environments (e.g., Azure,). Automate security practices in CI/CD pipelines using tools such as Jenkins, GitLab, or Azure DevOps. Ensure that all security checks are automated, including vulnerability scans, code analysis, and compliance checks before deployments.

Application Security: Collaborate with development teams to ensure secure coding practices and integrate application security tools (e.g., Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA)) into the CI/CD pipeline. Perform code reviews to identify and mitigate security vulnerabilities, ensuring that applications adhere to security best practices such as OWASP Top 10.

Security Monitoring and Incident Response: Assist in monitoring application and infrastructure environments for security incidents using tools like SIEM (e.g., Azure Sentinel) and Cloud Security Posture Management (CSPM). Respond to security alerts and coordinate with the security team to investigate and mitigate incidents. Participate in post-incident analysis and recommend enhancements to prevent recurrence.

Collaboration and Support: Collaborate with DevOps, security, and development teams to incorporate security measures into application development and deployment. Provide training and support to development teams on secure coding practices and security tooling. Assist with troubleshooting security issues and conducting root cause analysis

Compliance and Governance: Ensure adherence to security frameworks, such as ISO 27001, NIST, and regulatory requirements like GDPR or SOC 2. Work with compliance teams to support security audits, identify gaps, and implement controls. Ensure applications and infrastructure are configured in line with the organization’s security policies and regulatory requirements.

Security Tool Optimization and Maintenance: Configure, optimize, and maintain security tools, including vulnerability scanners, identity management solutions, and cloud security tools (e.g., Azure Security Center). Ensure that these tools are kept up to date with the latest security policies and are functioning efficiently in detecting and mitigating threats

What you’ll need to succeed?                          

Experience with CI/CD pipelines (Jenkins, GitLab, Azure DevOps)

Familiarity with application security practices, including secure coding and vulnerability management

Knowledge of security tools (e.g., SAST, DAST, CSPM)

Minimum 2-4 years of experience in DevSecOps, Cloud Security, or Application Security

Experience in cloud environments (Azure, AWS) and scripting (Python, Bash)

Experience with containerization (Docker, Kubernetes)

Ability to analyze complex situations, make sound judgments, and take decisive actions in high-pressure situations.

Strong verbal and written communication skills to effectively convey security issues and recommendations to both technical and non-technical stakeholders.

Certifications   Few of the following certifications:

Microsoft Azure Administrator (AZ-104) or Azure Security Engineer (AZ-500)

Certified Kubernetes Security Specialist (CKS)

CompTIA Security+, CEH, or equivalent security certifications

Certified Application Security Engineer (CASE) or equivalent for application security expertise

Azure/ Microsoft 365    Experience working on Azure Environment