We are seeking an experienced Lead DevSecOps Engineer to drive the integration of security practices into our development and deployment pipelines. In this role, you will design and implement secure CI/CD workflows, lead vulnerability management initiatives, and champion a security-first culture across engineering teams.

Please note that this role requires 3 days of work in the office.

Responsibilities

- Lead the design and implementation of DevSecOps practices across development and deployment pipelines
- Integrate SAST and DAST tools into the CI/CD toolchain to ensure continuous security validation
- Develop and maintain SBOM frameworks to support software transparency and compliance
- Drive software supply chain security initiatives to safeguard the end-to-end delivery lifecycle
- Build security integrations, pipeline automation, and tooling for secure CI/CD workflows using scripting languages
- Operate and optimize vulnerability scanning tools to identify, triage, and remediate security risks
- Apply industry-recognized security frameworks to guide threat modeling and risk mitigation
- Collaborate with cross-functional teams to embed security best practices into product development




- Mentor engineers on secure coding, automation, and modern DevSecOps methodologies

Requirements

- 7-14 years of experience working in DevSecOps and product cybersecurity environments
- Knowledge of SBOM frameworks and associated toolchains
- Background in software supply chain security
- Hands-on expertise in vulnerability scanning tools
- Proficiency in integrating SAST and DAST into CI/CD toolchains
- Solid scripting and automation skills using Python, Bash, or similar languages for security integrations and pipeline automation
- Hands-on experience with tools such as Black Duck, Trivy, and SonarQube, or Nexus and similar solutions
- Familiarity with security frameworks such as OWASP Top 10 and MITRE ATT&CK; or similar
- Competency in AWS
- English proficiency at an Upper-Intermediate level (B2) or higher

Nice to have

- Experience working in regulated industries such as automotive, industrial, or IoT
- Skills in container security and Kubernetes environments
- Familiarity with security monitoring and logging tools such as SIEM or centralized logging platforms

📌 Lead DevSecOps Engineer (Bengaluru)
🏢 EPAM Systems
📍 Bengaluru