DevSecOps Security Consultant

Quick Facts

• Role: DevSecOps Security Consultant

Description

Identify, assess, and remediate security vulnerabilities in software products. Manage vulnerabilities throughout development and deployment pipelines to protect organizational assets, support regulatory compliance, and improve the security posture across the SDLC. Collaborate with development, DevOps, and security teams to automate remediation workflows and strengthen application resilience.

Responsibilities

• Monitor, triage, and prioritize dependency, library, and third-party framework vulnerabilities
• Analyze security findings from SAST, DAST, and SCA tools (e.g., SonarQube, Checkmarx, OWASP ZAP, Dependabot)
• Implement and automate dependency update, vulnerability detection, and remediation processes in CI/CD pipelines and container environments (e.g., OpenShift)
• Document vulnerability assessments, remediation actions, and compliance evidence using Jira and vulnerability management platforms
• Apply secure development guidelines, dependency management standards, and secure best practices
• Report vulnerability status, remediation progress, and risk trends to stakeholders and security leaders
• Support incident response activities for critical vulnerability cases (including Zero-Day exploits and high-impact CVEs)
• Ensure adherence to internal policies and external regulations such as ISO 27001, NIST, GDPR, and SOC 2

Requirements

• Proficiency with SAST/DAST/SCA tools and dependency management across multiple ecosystems (npm, Maven, pip, NuGet)
• Proficiency in scripting and automation (Python, Bash) to integrate security processes into CI/CD workflows
• Expertise with containerization environments and security, especially OpenShift and Docker
• Deep knowledge of vulnerabilities (OWASP Top 10, CWE) and CVSS scoring methodology
• Proficiency with version control (Git, GitHub) and request tracking tools (Jira)
• Experience implementing security best practices in DevOps pipelines and cloud environments
• Strong analytical, problem-solving, and investigation capabilities

Qualifications

• Minimum 3 years of experience in application security, vulnerability management, or a related domain
• Mastery of SonarQube, Checkmarx, OWASP ZAP, and Dependabot
• Experience managing dependencies in npm, Maven, pip, NuGet, or Go Modules
• Ability to automate security processes in CI/CD pipelines and container platforms
• Knowledge of Cloud security principles (AWS, Azure, GCP) and container security practices is a plus
• Certifications CISSP, OSCP, CEH, or CCSP are an advantage
• Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards is a plus