Lập trình/script Python, Bash, PowerShell, YAML để tự động hóa bảo mật
Kiến thức sâu Secure SDLC, Threat Modeling, Zero Trust, IAM, Secrets/Vulnerability Management
Trách nhiệm
Thiết kế, triển khai DevSecOps và nhúng kiểm soát bảo mật xuyên suốt SDLC
Xây dựng, duy trì pipeline CI/CD an toàn (Jenkins, GitLab CI, GitHub Actions, Azure DevOps) tích hợp SAST, DAST, SCA, quét IaC
Triển khai bảo mật đa đám mây (AWS, Azure, GCP), container (Docker, Kubernetes, OpenShift) và IaC (Terraform, CloudFormation, Ansible)
Tự động hóa đánh giá, khắc phục lỗ hổng, policy-as-code; hỗ trợ giám sát, ứng phó sự cố và tuân thủ ISO 27001, PCI DSS, NIST, CIS, OWASP…
Có thì tốt
Chứng chỉ an ninh: CISSP, CISM, CEH, CompTIA Security+
Chứng chỉ bảo mật đám mây: AWS Security Specialty, AZ-500, Google Cloud Security Engineer
Chứng chỉ DevSecOps/Kubernetes: PDSP, CDP, CKS, CKA
Tóm tắt bằng AI từ JD gốc, đọc JD gốc trước khi ứng tuyển.
DevSecOps Specialist is responsible for integrating security practices into the Software Development Life Cycle (SDLC), CI/CD pipelines, cloud infrastructure, and operational processes. This role ensures that security is embedded throughout the development lifecycle while enabling agile delivery and maintaining compliance with organizational and regulatory requirements.
The position collaborates closely with Development, Infrastructure, Cloud Engineering, Quality Assurance, Architecture, and Information Security teams to build secure, scalable, and resilient systems.
Responsibilities
DevSecOps Integration
Design and implement DevSecOps practices across application development and infrastructure deployment processes.
Embed security controls throughout the SDLC.
Automate security testing and validation within CI/CD pipelines.
Establish secure coding, security-by-design, and shift-left security practices.
CI/CD Security
Build and maintain secure CI/CD pipelines using:
Jenkins
GitLab CI/CD
GitHub Actions
Azure DevOps
Integrate security scanning tools including:
SAST (Static Application Security Testing)
DAST (Dynamic Application Security Testing)
SCA (Software Composition Analysis)
IaC Security Scanning
Cloud & Infrastructure Security
Implement and maintain security controls across cloud platforms:
AWS
Microsoft Azure
Google Cloud Platform (GCP)
Secure containerized environments:
Docker
Kubernetes
OpenShift
Enforce infrastructure security through Infrastructure as Code (IaC):
Terraform
CloudFormation
Ansible
Security Automation
Automate vulnerability assessment and remediation processes.
Develop scripts and automation solutions using:
Python
Bash
PowerShell
Implement policy-as-code and compliance-as-code frameworks.
Vulnerability Management
Conduct security assessments and vulnerability reviews.
Analyze findings from:
Checkmarx
Veracode
SonarQube
Snyk
Fortify
Prisma Cloud
Aqua Security
Coordinate remediation activities with engineering teams.
Monitoring & Incident Response
Support security monitoring and logging initiatives.
Integrate security alerts into operational workflows.
Participate in security incident investigations and post-incident reviews.
Improve detection and response capabilities.
Compliance & Governance
Support compliance initiatives related to:
ISO 27001
PCI DSS
NIST Cybersecurity Framework
CIS Benchmarks
OWASP Top 10
SOC 2
Ensure systems comply with organizational security policies and regulatory requirements.
Security Awareness
Promote secure development practices among engineering teams.
Conduct threat modeling and secure code review workshops.
Provide technical guidance on security best practices.
Qualifications
Education
Bachelor‘s degree in:
Information Technology
Computer Science
Cybersecurity
Software Engineering
Related disciplines
At least 5+ years of experience in DevSecOps, Cloud Security, or Security Engineering.
Technical Skills
DevOps Tools
Git
GitHub
GitLab
Bitbucket
Jenkins
Azure DevOps
Cloud Platforms
AWS
Azure
GCP
Container & Orchestration
Docker
Kubernetes
OpenShift
Security Tools
SonarQube
Checkmarx
Veracode
Snyk
Fortify
Prisma Cloud
Aqua Security
Qualys
Nessus
Infrastructure as Code
Terraform
CloudFormation
Ansible
Programming/Scripting
Python
Bash
PowerShell
YAML
Security Knowledge
Secure SDLC
Threat Modeling
Secure Coding Practices
Zero Trust Architecture
Identity and Access Management (IAM)
Secrets Management
Vulnerability Management
Preferred Certifications
Security Certifications
CISSP
CISM
CEH
CompTIA Security+
Cloud Security Certifications
AWS Certified Security Specialty
Microsoft Azure Security Engineer Associate (AZ-500)
