Role Summary

The Senior Executive, DevSecOps Engineering is responsible for embedding security throughout the software development lifecycle (SDLC) and ensuring secure, scalable, and compliant technology delivery across cloud and on-premise environments. This role focuses on integrating security controls into development, testing, deployment, and operational processes while enabling teams to deliver applications efficiently and securely.

Working closely with engineering, infrastructure, cybersecurity, risk, and compliance teams, the incumbent will drive secure CI/CD practices, automate security controls, reduce technology risk, and promote a security-by-design culture. The role also supports governance initiatives, vulnerability management, incident response activities, and continuous improvement of security processes and standards.

Key Responsibilities

Secure Software Development Lifecycle (SDLC)

• Define and implement security requirements throughout the software development lifecycle.
• Conduct threat modeling, security reviews, and risk assessments during solution design and development phases.
• Ensure security considerations are embedded into application architecture and engineering processes.

Secure Development Practices

• Establish and maintain secure coding standards, development guidelines, and security best practices.
• Provide developers with security guidance, reusable frameworks, templates, and tooling.
• Promote security awareness and secure-by-design principles across engineering teams.

DevSecOps & Security Automation

• Integrate automated security testing into CI/CD pipelines.
• Implement application, infrastructure, and dependency security scanning throughout development and deployment workflows.
• Develop automated controls that identify and reduce security risks early in the delivery lifecycle.

Vulnerability Management

• Manage the identification, assessment, prioritization, and remediation of security vulnerabilities.
• Collaborate with development and infrastructure teams to resolve findings and validate remediation efforts.
• Track remediation progress and maintain visibility of security risks across environments.

Cloud & Infrastructure Security

• Implement and maintain secure configurations across cloud, infrastructure, and platform environments.
• Apply security controls for identity management, access control, encryption, networking, and workload protection.
• Support infrastructure security through automation, policy enforcement, and governance controls.

Identity & Access Management

• Ensure secure management of credentials, secrets, privileged access, and user identities.
• Implement role-based access controls and enforce segregation of duties where required.
• Promote secure authentication and authorization practices across platforms and applications.

Release & Deployment Security

• Establish security controls and approval processes within software deployment and release activities.
• Maintain auditability, traceability, and compliance throughout the release lifecycle.
• Support secure deployment, rollback, and change management procedures.

Security Monitoring & Incident Support

• Enhance security monitoring, alerting, and detection capabilities across applications and infrastructure.
• Support incident response, forensic investigations, and root cause analysis activities.
• Leverage operational findings and security events to improve preventive controls and risk management practices.

Governance, Risk & Compliance

• Implement security standards, policies, and controls aligned with industry frameworks and organizational requirements.
• Support audits, risk assessments, and compliance reviews by maintaining appropriate evidence and documentation.
• Develop metrics and reporting to measure security effectiveness, risk exposure, and remediation performance.

Collaboration & Continuous Improvement

• Partner with engineering, operations, risk, and compliance stakeholders to strengthen security posture.
• Mentor team members and promote knowledge sharing across technical teams.
• Drive continuous improvement initiatives for security processes, tooling, and operational effectiveness.

Qualifications

• Bachelor's Degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related discipline.
• Professional certifications in cybersecurity, cloud security, DevSecOps, or related disciplines are an advantage.
• Strong understanding of secure SDLC practices, application security, and software security principles.
• Knowledge of cloud security, infrastructure security, identity and access management, and secure deployment practices.
• Familiarity with security testing methodologies, vulnerability management, and risk assessment processes.
• Experience implementing security controls within CI/CD pipelines and automated delivery environments.
• Understanding of security frameworks, compliance requirements, and industry best practices.

Experience

• Minimum 3 years of experience in DevSecOps, application security, cloud security, cybersecurity engineering, or related technical roles.
• Hands-on experience integrating security controls into software development and deployment pipelines.
• Experience securing cloud and/or hybrid technology environments.
• Practical exposure to vulnerability management, security assessments, and remediation programs.
• Experience supporting security monitoring, incident response, and operational security activities.
• Demonstrated ability to collaborate effectively with engineering, infrastructure, security, and compliance teams.

Skills & Competencies

DevSecOps & Security Automation

• Experience implementing automated security controls within CI/CD pipelines and development workflows.
• Proficiency in scripting, automation, and security tooling.

Application Security

• Strong understanding of secure coding practices, application security testing, and vulnerability remediation.
• Ability to identify, assess, and mitigate security risks throughout the development lifecycle.

Cloud & Infrastructure Security

• Knowledge of cloud security, container security, infrastructure security, identity management, and platform protection mechanisms.
• Familiarity with infrastructure-as-code and security automation practices.

Risk & Compliance

• Understanding of information security governance, risk management, compliance requirements, and audit processes.
• Ability to translate security requirements into practical and measurable technical controls.

Security Monitoring & Incident Management

• Experience with security monitoring, logging, detection, incident response, and operational security processes.
• Strong analytical and problem-solving capabilities.

Communication & Collaboration

• Strong stakeholder management, documentation, and communication skills.
• Ability to work effectively with technical and non-technical teams to drive security initiatives.

Continuous Improvement & Security Leadership

• Proactive approach to improving security posture, automation, and operational effectiveness.
• Commitment to promoting a security-first culture and enabling secure technology delivery.