DevSecOps Engineer

Role Overview

TrueML is seeking a DevSecOps / Sr. Security Engineer to lead security integration across the SDLC. The role blends engineering, cloud infrastructure, and application security—driving automation, scalability, and secure-by-default development practices.

Responsibilities

Security Automation & CI/CD Integration (Core)

• Embed security controls and scanners into CI/CD pipelines (SAST, SCA, DAST, IaC, Container Security).
• Design and maintain automated security workflows across build, test, and deploy stages.
• Implement security gates, policy enforcement, and compliance checks within pipelines.
• CI/CD tooling: GitHub Actions, Jenkins, GitLab CI, Azure DevOps.

Cloud Security (AWS Focus)

• Secure cloud-native architectures on AWS: IAM, VPC, ECS/EKS, Lambda, S3, API Gateway.
• Operationalize CNAPP/CSPM tooling (e.g., Wiz, Prisma Cloud).
• Enforce least privilege, secrets management, and runtime protections.
• Define and maintain security policies for AWS, with emphasis on EKS/ECS and serverless (Lambda).
• Automate compliance via real-time monitoring and remediation to stay audit-ready (e.g., PCI, ISO 27001).
• Lead threat modeling and convert risks into actionable engineering plans.

Guard Infrastructure & AI Security

• Secure Infrastructure as Code templates (Terraform/CloudFormation) and manage cloud primitives (IAM, KMS, WAF).
• Develop security standards for Generative AI and use AI-powered tools to explore/defend against AI-driven threats.

What You Bring

• 7–10 years in software engineering, DevOps, or cloud engineering.
• 3+ years in a DevSecOps-focused role.
• Deep mastery of cloud security, vulnerability analysis, and incident response.
• Strong AWS expertise and ability to secure Terraform and containerized environments.
• Top-tier security certifications (e.g., CISSP, SANS GIAC, CASP) plus understanding of PCI and ISO 27001.
• Familiarity with OWASP and modern security tooling; ability to secure API integrations and data protection layers.
• Awareness of evolving AI regulations and curiosity about how threat actors use AI to bypass controls.
• Strong collaboration skills; ability to translate complex InfoSec work into clear, maintainable engineering tasks.