ROLE OVERVIEW

KEY RESPONSIBILITY AREAS (KRA)

• Establish Enterprise DevSecOps Governance - Establish and enforce DevSecOps governance across a highly heterogeneous software development environment, including Azure (ADO, Data Lake, Databricks, AI Foundry, Functions, APIM, LLMOps), service connections, artifacts, agents, GitHub Actions, Alibaba Cloud, Salesforce, SAP (IPD, TM, BTP), Java and .NET.
• Architectural Alignment – Partner with AppSec engineers and Enterprise security architects to embed security requirements, threat modelling triggers, secure design reviews, abuse cases and architecture security assurance checkpoints early in SSDLC.
• Framework Ownership – Maintain, Socialize, Nurture the client specific enterprise DevSecOps governance framework, defining mandatory controls, control ownership and documented DevSecOps exception processes and elevate to next level.
• Security Champion Enablement – Champion SSDLC practices by driving developer SSDLC trainings, building a network of Security Champions and sharing secure coding, 3^rd party software dependency management advisory to developers and business value streams.
• Continuous Maturity Tracking – Contribute to monthly DevSecOps posture reporting and quarterly maturity assessments to provide senior leadership visibility into risk reduction.
• Policy & Security-as-Code – Transform complex security, privacy, resilience, risk and compliance requirements into automated pipeline controls, maintain all scanning policies and pipeline security configurations via secure YAML versioning with mandatory peer review.
• Comprehensive Pipeline Integration – Engineer and embed automated security gates as frictionless guardrails across the SSDLC, incorporating IDE plugins, Secrets, SAST, IaC scanning, SCA, SBOM generation, DAST, API Security and container/artifact scanning.
• Lifecycle Governance – Architect secure lifecycle governance for foundational pipeline components including pipeline templates, marketplace actions, build agents, service connections, artifact registries, secret management and infrastructure modules.
• Framework Implementation and Enhancement – Design, document, deploy and enhance tailored DevSecOps design patterns and implementation frameworks that cater the client’s diverse and dynamic software development environments. Maintain a DevSecOps reference architecture, enterprise security architect approved tool catalogue, decision records and future technology roadmap.
• Frictionless Tuning – Monitor, maintain and tune security gate configurations to balance comprehensive risk coverage and build reliability against developer friction.
• Intelligent Triage and Remediation – Analyze code scanning results to eliminate false positives and prioritize critical and high severity issues based on true exploitability and application criticality before following on remediation with developers.
• Secret Management Workflow – Co-own the enterprise secrets detection workflow along with enterprise security architects. Ensure quick notification of hardcoded credentials, tracking key rotation compliance by developer/owners. Act with strict escalations for delayed remediations.
• SLA and Remediation Enforcement – Design and document DevSecOps compensating controls and risk acceptance plans. Track code-level finding to closure within client eco-system and escalate at-risk items before SLA breaches.
• Automated Telemetry – Build real-time security dashboards with automated alert-triggering pipelines to monitor client specific severity-based remediation alerts.
• Posture Reporting – Participate & influence in monthly DevSecOps posture reporting and quarterly maturity assessment inputs.

KEY PERFORMANCE INDICATORS (KPIs)

• Continuous Metrics and Improvement figures across Secrets, SAST, IaC scanning, SCA, SBOM generation, DAST, API Security and container/artifact scanning.
• Security gate pass rate, measured as builds passing all gates without override.
• Secrets detection response, measured by notification timeliness and the absence of confirmed secrets open beyond agreed thresholds.
• Open-source dependency risk exposure in production dependencies.
• Remediation SLA adherence for Critical and High severity findings across DevSecOps controls within SSDLC.
• False-positive rate in code scanning output following tuning.
• Development team feedback on the enablement, clarity and actionability of remediation guidance.

REQUIRED TECHNICAL SKILLS & EXPERIENCE

• Hands-on working proficiency in Core Java, .NET CLI, Apex, Salesforce CLI (SFDX), ABAP, Maven, Eclipse, VS Code including package management, unit testing, and secure artifact publishing.
• Deep understanding of TypeScript, JavaScript and Node.js dependencies and application delivery workflow.
• In depth experience in writing robust automation in Python and PowerShell for pipelines and pipeline of pipelines, security control validation, REST API integration and operation remediation code fixes.
• Working experience in utilizing YAML, JSON, XML and jq for configuration transformation, pipeline definitions and automated policy enforcement.
• In depth expertise in Terraform module development, remote state management, securing Azure deployments and Azure Data ecosystems.
• Developed secure release pipelines using Azure DevOps, AWS CodeCommit/CodePipeline/CodeDeploy, Copado and GitHub Actions.
• Engineered continuous security gates across SSDLC, having IDE plugins, Secrets Detection, SAST, IaC scanning, SCA, SBOM generation, DAST, API Security and container/artifact scanning.
• Deep expertise in Azure Key Vault, AWS Secrets manager, AWS KMS, ACM, Microsoft Entra, RBAC, PIM.
• Engineered secure network boundaries, DevSecOps controls and implementing policy-as-code utilizing VNets, VPC, Private Endpoints, NSGs, WAF, DNS routing, egress control and micro segmentation.
• Experience in securing and implementing DevSecOps controls around Azure Data Lake, PaaS/SaaS data services, encryption, private connectivity and Serverless security models.
• Integrating security logging and incidence response via Azure Monitor, Microsoft Defender for Cloud, Armis and Microsoft Sentinel.
• Maintained DevSecOps control documents mapped as appropriate to NIST SSDF, NIST CSF2.0, CIS Controls, ISO/IEC 27001, OWASP best practices and internal/client policies.
• Strong collaboration skills, with proven ability to work alongside development teams and influence secure engineering practice without owning the codebase.

PREFERRED / EXPECTED CERTIFICATIONS

• Azure Security or Certified DevSecOps Professional or AZ-400, AZ-500 or successor credentials are preferred. Not replaceable with required technical skills.
• Azure DevOps certification (preferred)
• GitHub Advanced Security Certificate
• Sync/FOD/WiZ Code/Azure Key Vault/ AWS KMS certified
• CSSLP (preferred)
• CompTIA Security+ or equivalent foundational security certification

EDUCATIONAL QUALIFICATION

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent practical experience)