Full Time DevSecOps Engineer Jobs, in Cloud Kinetics Selangor - Maukerja

The Senior Executive, DevSecOps Engineering will own and embed security controls across the end-to-end software development lifecycle (SDLC)—requirements, architecture, coding, build, test, release, deployment, and operations. The role will engineer secure-by-default CI/CD pipelines, automate risk-based security gates, and provide developers with timely, actionable feedback so vulnerabilities are prevented or remediated before production. Working across engineering, cloud, infrastructure, cybersecurity, risk, and compliance teams, the incumbent will reduce application, platform, and software supply-chain risk across hybrid environments, primarily AWS.

KEY RESPONSIBILITIES

1. Security Requirements & Threat Modelling: Define security and privacy requirements during planning and architecture; facilitate threat modelling, abuse-case analysis, and risk reviews before implementation.
2. Secure Coding & Developer Guardrails: Establish secure coding standards, reusable pipeline templates, approved components, branch protections, peer-review controls, pre-commit checks, and developer guidance aligned with OWASP practices.
3. Automated Application Security Testing: Integrate and tune SAST, DAST, SCA, secrets detection, API security testing, container scanning, and infrastructure-as-code scanning to provide fast, actionable feedback.
4. Risk-Based Pipeline Gates: Implement severity, exploitability, asset-criticality, and compliance-based thresholds that block unacceptable risk while allowing documented, time-bound exceptions with accountable approval.
5. Software Supply-Chain Security: Secure source, runners, build systems, dependencies, artifacts, registries, and deployment workflows using least privilege, isolated builds, SBOMs, provenance, signing, integrity verification, and trusted repositories.
6. Vulnerability Remediation & Assurance: Triage findings, remove false positives, assess business impact, assign owners, track remediation service levels, verify fixes, manage risk acceptance, and report overdue exposure.
7. Cloud, Container & IaC Security: Apply secure baselines and policy-as-code to AWS, Terraform, Ansible, CloudFormation, Docker, serverless services, IAM, networks, encryption, data services, and cloud configurations.
8. Secrets, Identity & Access: Prevent credentials in code and pipelines; implement managed secrets, rotation, workload identity, short-lived credentials, role-based access, privileged access controls, and segregation of duties.
9. Secure Release & Deployment: Maintain traceable approvals, immutable artifacts, controlled environment promotion, deployment verification, rollback readiness, and release evidence for production changes.
10. Runtime Security & Feedback Loops: Improve security logging, detection, alerting, workload monitoring, incident playbooks, and forensic readiness; feed production findings, incidents, and penetration-test results back into backlog and pipeline controls.
11. Governance, Metrics & Enablement: Translate internal standards and applicable requirements, including BNM RMiT, into automated controls and audit evidence; track control coverage, mean time to remediate, defect escape rate, exception ageing, and recurring root causes while coaching engineering teams.

Work Experience

1. 3+ years of hands-on experience in DevSecOps, application security, cloud security, platform engineering, or secure CI/CD delivery across hybrid environments.
2. Demonstrated experience embedding automated security testing and policy checks into build, test, release, and deployment pipelines without creating unnecessary delivery friction.
3. Practical experience securing AWS services, identities, networks, containers, serverless workloads, and infrastructure-as-code.
4. Experience triaging vulnerabilities, coordinating remediation, managing risk exceptions, and producing evidence for security reviews and audits.
5. Exposure to security monitoring, SIEM integration, incident response, detection engineering, and observability within 24x7 operational environments.
6. Proven ability to collaborate with developers, security, risk, compliance, infrastructure, and operations teams and to communicate security findings with clear, actionable remediation guidance.

Skills & Competencies

1. DevSecOps Automation: Proficiency in Python, Bash, or PowerShell and in automating repeatable security controls and evidence collection.
2. Application & Pipeline Security: Strong capability in SAST, DAST, SCA, secrets detection, API testing, security gates, and secure build and release design.
3. Cloud-Native Security: Working knowledge of cloud, IAM, containers, serverless, infrastructure-as-code, encryption, and policy-as-code security.
4. Risk, Compliance & Governance: Ability to convert regulatory and security requirements into proportionate, traceable, and measurable engineering controls.
5. Collaboration & Security Enablement: Skilled in partnering with engineering teams, explaining risk in practical terms, documenting standards, and promoting a security-by-design culture.