Key Responsibilities
- Secure SDLC & CI/CD o Embed security checks into every pipeline: SAST, DAST, SCA, secrets scanning, container and IaC scanning. o Define security gates and quality thresholds that block risky releases without slowing delivery. o Secure the software supply chain: dependency management, image signing, SBOMs and artifact provenance.
- Product & Application Security o Run threat modelling and security design reviews for recent features, services and APIs. o Define secure coding standards, authentication/authorization patterns and encryption practices for product teams. o Coordinate penetration tests, smart-contract audits and bug bounty findings; track remediation to closure.
- Cloud Workload Security o Secure Kubernetes, container and serverless workloads across AWS, Azure and GCP. o Manage secrets and keys (Vault, KMS, Key Vault) and enforce least-privilege IAM for applications. o Run cloud security posture management and policy-as-code guardrails with the Cloud & IT Infrastructure team.
- Compliance Automation o Translate SOC 2, ISO 27001, PCI-DSS, GDPR and DPDP Act requirements into technical controls for our products. o Automate evidence collection and continuous compliance monitoring; support external audits. o Maintain data classification, logging, retention and privacy controls in our applications.




- Vulnerability Management & Incident Response o Own vulnerability triage and fix SLAs across code, dependencies, containers and cloud workloads. o Set up security logging and SIEM alerts for products; lead investigation of product security incidents.
- Enablement & Leadership o Train developers on secure coding and run security champions across product teams. o Answer client security questionnaires and support enterprise security reviews. o Hire and mentor security engineers as the function grows. 3. Skill Set Required
- DevSecOps Tooling: SonarQube, Snyk, Checkmarx, OWASP ZAP/Burp Suite, Trivy, Checkov, Gitleaks
- CI/CD: GitHub Actions, GitLab CI, Jenkins or Azure DevOps
- Application Security: OWASP Top 10 and API Top 10, OAuth2/OIDC, JWT, encryption, threat modeling (STRIDE)
- Cloud & Container Security: AWS/Azure/GCP security services, Kubernetes security, Wiz/Prisma Cloud, OPA/Kyverno
- Secrets & Keys: HashiCorp Vault, AWS KMS/Secrets Manager, Azure Key Vault
- Compliance: SOC 2, ISO 27001, PCI-DSS, GDPR, DPDP Act; compliance automation (Vanta/Drata or similar)
- Monitoring & SIEM: Splunk, Microsoft Sentinel, ELK, AWS Security Hub
- Coding & Scripting: Python, Bash and ability to read Go, Java, JavaScript/TypeScript or Solidity code

📌 Hiring For Devsecops Lead Position (Pune)
🏢 Growing Careers
📍 Pune