Senior Security Engineer / Lead Security Engineer
About the role
IFS is seeking a Senior or Lead Security Engineer to provide technical leadership in security engineering across the organization. The role involves setting technical direction, owning critical security domains such as AppSec, CloudSec, CI/CD security, and vulnerability management, and driving cross-team security initiatives. The position is responsible for developing security automation strategies, evaluating and applying AI and generative AI tools, leading incident response, and mentoring engineers. Candidates should have a strong background in security engineering, hands-on experience with automation, and practical fluency with AI tools in an engineering context. The company offers a global, diverse, and flexible work environment with a focus on innovation and inclusion.
Must have
- Typically 4+ years in security engineering, software engineering, or platform engineering.
- Proven track record owning security capabilities or programs at scale.
- Deep expertise across multiple domains (AppSec, CloudSec, CI/CD security, architecture).
- Strong hands-on engineering and automation background.
- Demonstrated technical leadership and cross-team influence.
- Practical fluency with AI tools in an engineering context — for example AI coding assistants, AI-assisted security scanning and triage, or LLM-based analysis — and the judgment to validate their output rather than trust it blindly.
- Demonstrated experience in security engineering with hands-on involvement in automated security solutions.
- Working knowledge of DevSecOps principles and practices.
- Practical experience with CI/CD tools (e.g., Bitbucket, Jenkins, GitLab, GitHub Actions, or equivalent).
- Proficiency in security platforms, vulnerability management tools, and at least one scripting language (e.g., Python, Bash).
- Comfort working with AI-assisted development and security tools (e.g., AI coding assistants, AI-driven SAST/DAST/SCA triage) as part of the day-to-day toolkit, with the judgment to review and validate AI-generated output.
- Solid understanding of common vulnerabilities (e.g., OWASP Top 10) and remediation approaches.
- Strong communication and collaboration skills with the ability to engage cross-functional teams.
- Familiarity with containerization tools (e.g., Docker, Kubernetes).
- Knowledge of security standards (e.g., NIST, ISO 27001, CIS).
Technologies
- Bash
- Bitbucket
- CI/CD
- Container Security
- DAST
- DevSecOps
- Docker
- FedRAMP
- Generative AI
- GitHub
- GitHub Actions
- GitLab
- IFS
- Infrastructure as Code
- ISO 27001
- Jenkins
- Kubernetes
- LLM
- NIST
- OWASP
- Penetration Testing
- Python
- SAST
- SOC 2
Highlights
The company supports hybrid and flexible work arrangements to accommodate diverse needs and lifestyles. The role is technical leadership, not people management. The company values diversity and inclusion and encourages applicants from all backgrounds.
Jobs across Sri Lanka, watched for you.Colombo, Sri Lanka