About the job
As a Security Engineer, you will play a pivotal role in embedding DevSecOps security protocols throughout the Software Development Life Cycle (SDLC) and Continuous Integration/Continuous Deployment (CI/CD) processes using Azure DevOps Server. You will ensure robust security measures are in place, effectively manage vulnerabilities, and maintain audit-ready documentation.
Key Responsibilities
- Configure and optimize Fortify SAST/DAST tools, setting appropriate thresholds and managing exception workflows.
- Automate the renewal and deployment of SSL/TLS certificates utilizing tools such as HashiCorp Vault and Cert-Manager in Kubernetes, mitigating downtime and security vulnerabilities.
- Integrate Software Bill of Materials (SBOM) generation tools into the CI/CD pipeline to oversee component dependencies, license compliance, and vulnerabilities, ensuring transparency within the software supply chain.
- Implement image signing and verification protocols using tools like Sigstore/Cosign to guarantee code integrity, confirming that only verified and trusted container images are deployed.
- Establish Quality Gates, define vulnerability SLAs, and create triage processes along with remediation tracking and reporting dashboards.
- Incorporate secrets management practices using HashiCorp Vault and secure access methods with SecurEnvoy MFA.
- Provide support for compliance documentation, including scan outputs, approvals, and release evidence packs.
- Collaborate closely with DevOps and QA teams to establish secure pipeline and test environment controls.
