Senior DevSecOps Engineer
About the role
CoverageX is hiring a Senior DevSecOps Engineer to lead infrastructure security, vulnerability management, patch coordination, and security automation across their technology environment. The role involves proactively identifying and assessing security vulnerabilities, determining remediation urgency, and balancing security with operational stability. The engineer will collaborate across multiple engineering teams, communicate security risks, coordinate remediation, and ensure structured, risk-based vulnerability management. Key responsibilities include vulnerability management, infrastructure and application security, cross-team coordination, incident response, and security automation. Candidates should have significant experience in DevSecOps or related fields, strong technical judgment, and the ability to take ownership of security initiatives.
Must have
- 5+ years of experience in DevSecOps, infrastructure engineering, cloud security, or a related technical security role.
- Proven experience identifying, assessing, prioritizing, and coordinating remediation of security vulnerabilities across production environments.
- Strong understanding of CVEs, CVSS, emerging security threats, exploitability assessment, and risk-based vulnerability management.
- Experience securing cloud infrastructure, web applications, APIs, authentication systems, and third-party dependencies.
- Familiarity with vulnerability scanning, dependency monitoring, and automated security tools.
- Experience with CI/CD pipelines, software deployment processes, and security best practices across development environments.
- Experience evaluating end-to-end application security controls, including authentication, session management, security event logging, threat detection, alerting, and incident response across frontend and backend systems.
- Strong communication and organizational skills, with demonstrated ability to collaborate across multiple engineering teams, communicate security risks, and coordinate remediation efforts.
Nice to have
- Hands-on experience with Linux administration, cloud infrastructure, containers, and network security.
- Experience with tools such as Snyk, Dependabot, Trivy, Tenable, Qualys, or equivalent platforms.
- Familiarity with PHP, Node.js, Swift/iOS, Android, and modern web application architectures.
- Experience with Cloudflare, Railway, AWS, GCP, or similar infrastructure platforms.
- Experience with scripting and automation using TypeScript, JavaScript, Python, Bash, or similar languages, with the ability to develop and integrate security tooling into existing development workflows.
- Familiarity with endpoint security and device management solutions.
- Knowledge of OWASP security standards, NIST Cybersecurity Framework, or CIS Controls.
Technologies
- Android
- Authentication
- AWS
- Bash
- CI/CD
- Cloud Security
- Cloudflare
- Cybersecurity
- DevSecOps
- GCP
- iOS
- JavaScript
- Linux
- Network Security
- NIST
- Node.js
- OWASP
- PHP
- Python
- Swift
- TypeScript
- Vulnerability Scanning
Jobs across Sri Lanka, watched for you.Colombo, Sri Lanka