Senior DevSecOps Specialist

Tangem AG · Switzerland · posted today ago

Listing supplied by Himalayas. 101 Careers did not originate this post and applications are handled by the employer.

About this role

You will work closely with Development and DevOps teams to integrate security into every stage of the software development lifecycle.
Your primary focus will be on building and improving secure development practices, implementing AI-powered security code review, automating security testing, and protecting our CI/CD pipelines and software supply chain.
We aim to integrate AI-assisted security analysis throughout the code review and verification process, making security checks more effective, scalable, and automated.
This is a hands-on engineering role focused on practical security improvements, automation, and collaboration with development teams.

Responsibilities

Design, implement, and continuously improve security controls across CI/CD pipelines and GitHub repositories.
Lead the implementation and continuous improvement of AI-powered security code review, integrating AI-assisted security analysis into pull requests, CI/CD pipelines, and development workflows.
Establish and improve secure code review practices, including branch protection, pull request approval rules, CODEOWNERS, and security reviews for critical code changes.
Implement and maintain automated security testing, including SAST, SCA (dependency scanning), secrets scanning, and other relevant security checks.
Integrate AI-assisted security verification with traditional security scanning tools, improving vulnerability detection, review quality, and remediation workflows.
Configure and optimize security quality gates to identify and prevent critical vulnerabilities before code is merged or released.
Strengthen software supply chain security, including third-party dependencies, CI/CD access permissions, build processes, and artifact integrity.
Identify security weaknesses in development workflows and implement preventive controls.
Develop scripts, integrations, and automation tools to improve security processes and reduce manual work.
Work with development teams to investigate security findings, prioritize remediation, and improve secure coding practices.
Support the configuration and improvement of Cloudflare security services, including WAF and API protection, when required.
Contribute to other security engineering and infrastructure security automation initiatives.

Requirements

5+ years of practical experience in DevSecOps, DevOps, or a similar technical security role.
Strong hands-on experience with GitHub, GitHub Actions, and CI/CD security.
Proven hands-on experience implementing AI-powered security code review solutions, including their integration into pull request workflows, CI/CD pipelines, and automated security verification processes.
Practical experience implementing SAST, SCA, and secrets scanning solutions (e.g., CodeQL, SonarQube, Semgrep, Dependabot, or similar tools).
Experience establishing secure code review workflows, branch protection policies, and automated security checks.
Good understanding of secure software development practices, common application vulnerabilities, and software supply chain risks.
Experience with security automation and scripting using Python, Bash, or similar languages.
Understanding of cloud infrastructure security fundamentals, including AWS IAM, access management, and secrets management.
Ability to independently implement security improvements and troubleshoot technical issues.
Strong communication skills and the ability to collaborate effectively with development teams.

Nice to have:

Experience with Cloudflare security products (WAF, API Shield, Zero Trust).
Experience securing Kubernetes, Docker, and AWS environments.
Experience with Terraform and Infrastructure as Code security scanning.
Familiarity with mobile application development and security (Swift, Kotlin).
Experience with DAST, SBOM generation, artifact signing, and supply chain security frameworks.
Experience developing custom AI security agents, evaluation frameworks, or automated vulnerability triage workflows.
Experience working in fintech, blockchain, or other security-sensitive industries.