Security Engineer (DevSecOps)

About the role

We are a regulated fintech and cryptocurrency group seeking a Security Engineer (DevSecOps) to join as one of the first two security hires. Working under the CISO and alongside a GRC Manager, you will own the technical engineering side of compliance and ensure security controls are built into our infrastructure and applications.

Key responsibilities

• Translate security and audit requirements into scoped engineering tasks and coordinate implementation with DevOps and R&D.
• Produce audit‑ready compliance evidence such as cloud configuration exports, access reviews, network posture reports, and CI/CD logs.
• Run internal vulnerability scans, validate external pen‑test findings, and manage remediation cycles.
• Own CI/CD security gates, define pass/fail thresholds for SAST, dependency and container scans, and package results as compliance proof.
• Assess cloud and edge posture, manage WAF/CDN security rules, and remediate misconfigurations.
• Lead end‑to‑end vulnerability management from detection to closure.
• Co‑build and maintain a Kubernetes‑native security monitoring platform.
• Support incident response through log analysis and containment under CISO direction.

Required profile

• Strong DevOps and infrastructure background with hands‑on experience in AWS, Kubernetes, CI/CD pipelines and infrastructure‑as‑code.
• Proven ability to work in highly regulated environments (PCI DSS, ISO 27001, SOC 2, CCSS).
• Experience delivering technical compliance evidence and interacting with audit teams.
• Self‑starter with high ownership and ability to communicate precise, actionable security requests.

Required skills

• AWS
• Kubernetes
• CI/CD (e.g., Jenkins, GitLab, GitHub Actions)
• Infrastructure‑as‑code (Terraform, CloudFormation)
• SAST, dependency and container scanning tools
• Software Bill of Materials (SBOM) generation
• Web Application Firewall (WAF) and CDN security configuration
• Vulnerability scanning and management
• Incident response and log analysis