EPAM is a leading global provider of digital platform engineering and development services. We are committed to having a positive impact on our customers, our employees, and our communities. We embrace a dynamic and inclusive culture. Here you will collaborate with multi-national teams, contribute to a myriad of innovative projects that deliver the most creative and cutting-edge solutions, and have an opportunity to continuously learn and grow. No matter where you are located, you will join a dedicated, creative, and diverse community that will help you discover your fullest potential.

We are looking for a seasoned Lead DevSecOps Engineer to lead the embedding of security practices into our development and deployment pipelines. In this position, you will architect and roll out secure CI/CD workflows, spearhead vulnerability management efforts, and promote a security-first mindset across engineering teams.

Please note that this role requires 3 days of work in the office.

Responsibilities

- Lead the design and rollout of DevSecOps practices across development and deployment pipelines
- Integrate SAST and DAST tools into the CI/CD toolchain to enable continuous security validation
- Develop and maintain SBOM frameworks that support software transparency and compliance
- Drive software supply chain security initiatives to protect the end-to-end delivery lifecycle
- Build security integrations, pipeline automation, and tooling for secure CI/CD workflows via scripting languages
- Operate and fine-tune vulnerability scanning tools to detect, triage, and remediate security risks
- Apply industry-recognized security frameworks to inform threat modeling and risk mitigation
- Collaborate with cross-functional teams to embed security best practices into product development




- Mentor engineers in secure coding, automation, and modern DevSecOps methodologies

Requirements

- 7-14 years of experience in DevSecOps and product cybersecurity environments
- Knowledge of SBOM frameworks and their related toolchains
- Background in software supply chain security
- Expertise in vulnerability scanning tools
- Proficiency in embedding SAST and DAST into CI/CD toolchains
- Skills in scripting and automation with Python, Bash, or similar languages for security integrations and pipeline automation
- Showcase of hands-on experience with tools like Black Duck, Trivy, and SonarQube, or Nexus and comparable solutions
- Familiarity with security frameworks like OWASP Top 10 and MITRE ATT&CK; or similar
- Competency in AWS
- Proficiency in English at an Upper-Intermediate level (B2) or above

Nice to have

- Background in regulated sectors such as automotive, industrial, or IoT
- Expertise in container security and Kubernetes environments
- Understanding of security monitoring and logging tools like SIEM or centralized logging platforms

We offer

- Opportunity to work on technical challenges that may impact across geographies
- Vast opportunities for self-development: online university, knowledge sharing opportunities globally, learning opportunities through external certifications
- Opportunity to share your ideas on international platforms
- Sponsored Tech Talks & Hackathons
- Unlimited access to LinkedIn learning solutions
- Possibility to relocate to any EPAM office for short and long-term projects
- Focused individual development
- Benefit package:
- Health benefits
- Retirement benefits
- Paid time off
- Adaptable benefits

- Forums to explore beyond work passion (CSR, photography, painting, sports, etc.)

📌 Lead DevSecOps Engineer (Bengaluru)
🏢 EPAM Systems
📍 Bengaluru