We are looking for a Lead DevSecOps Engineer to embed security into CI/CD pipelines and strengthen secure delivery across teams. You will integrate SAST and DAST, run vulnerability management, and drive SBOM and software supply chain security efforts while promoting a security-first mindset. This role requires 3 days in the office—apply to join us.

Responsibilities

- Lead the rollout and evolution of DevSecOps practices across development and deployment pipelines
- Implement SAST and DAST integrations within the CI/CD toolchain to enable continuous security validation
- Design and maintain SBOM frameworks to improve software transparency and compliance
- Drive software supply chain security initiatives that protect the end-to-end delivery lifecycle
- Build security integrations, pipeline automation, and tooling for secure CI/CD workflows using scripting languages
- Run and tune vulnerability scanning tools to identify, triage, and remediate security risks
- Apply industry-recognized security frameworks to guide threat modeling and risk mitigation
- Collaborate with cross-functional teams to embed security best practices into product development
- Mentor engineers on secure coding, automation,



and up-to-date DevSecOps methodologies

Requirements

- Proven track record with 7-14 years in DevSecOps and product cybersecurity environments
- Working knowledge of SBOM frameworks and the related toolchains
- Solid background in software supply chain security concepts and practices
- Hands-on experience with vulnerability scanning tools in real delivery pipelines
- Strong proficiency integrating SAST and DAST into CI/CD toolchains
- Advanced scripting and automation skills using Python, Bash, or similar languages for security integrations and pipeline automation
- Practical expertise with tools such as Black Duck, Trivy, and SonarQube, or Nexus and similar solutions
- Deep understanding of security frameworks such as OWASP Top 10 and MITRE ATT&CK; or similar
- Strong competency in AWS
- English proficiency at an Upper-Intermediate level (B2) or higher

Nice to have

- Experience in regulated industries such as automotive, industrial, or IoT
- Exposure to container security and Kubernetes environments
- Familiarity with security monitoring and logging tools such as SIEM or centralized logging platforms

📌 Lead DevSecOps Engineer (Bengaluru)
🏢 EPAM Systems
📍 Bengaluru