We are hiring a Lead DevSecOps Engineer to integrate security controls into build and release workflows and help teams ship safely at speed. You will enhance secure CI/CD by embedding SAST and DAST, managing vulnerabilities, and advancing SBOM and supply chain security practices. The position is onsite 3 days per week, so apply today.

Responsibilities

- Lead the adoption of DevSecOps practices throughout development and deployment pipelines
- Embed SAST and DAST tools into the CI/CD toolchain to maintain continuous security validation
- Develop and sustain SBOM frameworks that support software transparency and compliance needs
- Champion software supply chain security initiatives across the end-to-end delivery lifecycle
- Create security integrations, pipeline automation, and tooling for secure CI/CD workflows using scripting languages
- Operate and improve vulnerability scanning tools to identify, triage, and remediate security risks
- Use industry-recognized security frameworks to steer threat modeling and risk mitigation
- Partner with cross-functional teams to weave security best practices into product development
- Coach engineers on secure coding, automation, and modern DevSecOps methodologies





Requirements

- Extensive experience of 7-14 years in DevSecOps and product cybersecurity environments
- Knowledge of SBOM frameworks along with their supporting toolchains
- Background in software supply chain security for end-to-end delivery
- Hands-on expertise using vulnerability scanning tools to find and prioritize risks
- Demonstrated ability to integrate SAST and DAST into CI/CD toolchains
- Solid automation and scripting capability in Python, Bash, or similar languages for security integrations and pipeline automation
- Hands-on experience with Black Duck, Trivy, and SonarQube, or Nexus and similar solutions
- Familiarity with OWASP Top 10, MITRE ATT&CK;, or similar security frameworks
- Practical competency working in AWS
- English proficiency at an Upper-Intermediate level (B2) or higher

Nice to have

- Experience with regulated industries such as automotive, industrial, or IoT
- Container security skills, including work in Kubernetes environments
- Awareness of security monitoring and logging tools such as SIEM or centralized logging platforms

📌 Lead DevSecOps Engineer (Bengaluru)
🏢 EPAM Systems
📍 Bengaluru