DevSecOps

As DevSecOps Engineer, you ll sit inside the Platform team, reporting to the DevOps Lead, with security as your specialty and your primary lens on every piece of infrastructure you touch. You are an DevOps/SRE first comfortable with cloud, containers, IaC, and production on-call with deep, hands-on expertise in the controls that keep that infrastructure secure: identity and privileged access, AWS-native guardrails, Kubernetes hardening, runtime detection, and pipeline security. This is a transversal role. You ll work across DevSecOps, security monitoring integration, and the infrastructure-facing edges of application security, partnering closely with the CISO/GRC function, Head of IT, and Head of AI. You are a builder, not an assessor: your output is running controls, detection rules, and pipeline gates not reports about what someone else should build. Own IAM architecture and least-privilege access across AWS accounts and Kubernetes (RBAC, service accounts, namespace isolation), and maintain AWS Organizations-level guardrails (SCPs, account baselines) Own Okta integration for workforce identity SSO, SCIM provisioning/deprovisioning, and conditional access policies Implement and operate Privileged Access Management (PAM) e.g. Teleport for infrastructure and production access, including session recording, approval workflows, and lifecycle automation Design and operate a secrets management solution (e.g. Vault, AWS Secrets Manager) across infrastructure and CI/CD, including rotation, dynamic secrets, and eliminating hardcoded credentials Implement AWS-native security controls (GuardDuty, Security Hub, Config, KMS, network segmentation, WAF) and harden Kubernetes clusters end-to-end Design and operate CI/CD security controls end-to-end: IaC scanning (Checkov or equivalent), container image scanning (Trivy or equivalent), SAST, SCA, secrets scanning, and artifact signing/provenance, with enforced gates Deploy and tune runtime threat detection for containers and workloads (Falco or equivalent), including writing custom detection rules Bootstrap security monitoring from the ground up: build the telemetry pipeline that feeds infrastructure, cloud, Kubernetes, and pipeline security signals into Mal s central monitoring/SIEM platform, and stand up the first correlation rules and alerting Support secure SDLC practices at the infrastructure boundary secrets handling, dependency management, secure deployment patterns as the technical bridge between application security and infrastructure enforcement Carry standard SRE

Responsibilities

Experience

IAM, Organizations/SCPs, VPC networking, GuardDuty/Security Hub/Config, KMS Production Kubernetes experience with security-relevant configuration: RBAC, network policies, admission control, secrets management Experience with Terraform (or equivalent IaC) and IaC security scanning (Checkov or comparable) Experience with container image scanning integrated into CI/CD (Trivy or comparable) Experience implementing a PAM solution (Teleport or comparable e.g. Boundary) Experience integrating identity providers (Okta or comparable) into infrastructure access and application SSO Experience designing and operating a secrets management solution (Vault, AWS Secrets Manager, or comparable) Solid scripting/automation ability (Python, Go, or Bash) this is a builder role, not a config-only role Demonstrated experience designing and operating CI/CD pipeline security controls (SAST, SCA, secrets scanning, IaC/container scanning) Experience building the pipes that feed infrastructure and application events into a SIEM or central monitoring platform ideally from a greenfield/bootstrap starting point Comfortable operating in a regulated environment (financial services, fintech, or similarly compliance-heavy sector) Direct experience with Falco or another runtime/eBPF-based threat detection tool, including writing custom rules Hands-on experience with a specific SIEM/central monitoring platform (e.g. Wazuh, Splunk, Elastic, Sentinel, Chronicle) from the engineering/integration side Experience in a bank, fintech, or ADGM/CBUAE-regulated environment Familiarity with CBUAE or similar regulatory technology-risk expectations (authentication, session integrity, logging retention) Exposure to service mesh security (mTLS, Istio/Linkerd policies) Experience with policy-as-code frameworks beyond Terraform scanning (OPA/Gatekeeper, Kyverno) AWS Security Specialty certification or equivalent cloud security credential CKS (Certified Kubernetes Security Specialist) or CKA Prior experience building or operating a detection engineering practice (writing, testing, and tuning detections against MITRE ATT&CK or similar) Familiarity with mobile app backend security patterns

Desired Candidate Profile

Experience