Senior DevSecOps Engineer

Job Description

Requirements

• - Lead initiatives to improve and enhance DevSecOps maturity across the organization.
• - Conduct DevSecOps and Application Security maturity assessments against recognized frameworks and standards, including BSIMM 15, OWASP DSOMM, and OWASP DSOVS.
• - Assess control coverage, pipeline maturity, security practices, control duplication, and high-risk areas, and identify gaps and improvement opportunities.
• - Design, review, and coordinate the integration of security controls into CI/CD pipelines, including:
• - SAST
• - SCA
• - DAST
• - IAST
• - Secrets Management
• - Infrastructure as Code (IaC) Scanning
• - Establish and govern vulnerability triage, prioritization, tracking, and remediation processes, including defined SLAs.
• - Lead the implementation, configuration, and optimization of application, API, and secure development security tools.
• - Develop and maintain technical standards, documentation, security guidelines, templates, checklists, and operational runbooks.
• - Lead knowledge transfer activities and provide technical guidance to client teams.
• - Provide technical mentorship and guidance to DevSecOps, cybersecurity, and software development teams.
• - Monitor and report on Application Security KPIs, metrics, and DevSecOps maturity indicators.
• - Support the alignment of security policies and standards with global best practices and applicable local regulatory requirements.
• - Promote secure software development practices throughout the Software Development Life Cycle (SDLC).
• Requirements & Qualifications
• - Minimum 7 years of relevant professional experience, including experience in Senior and/or Lead-level roles.
• - Proven experience leading Threat Modeling, secure design reviews, and end-to-end implementation of security tools.
• - Proven experience conducting DevSecOps and/or Application Security maturity assessments using frameworks such as BSIMM and/or OWASP DSOMM, including evidence collection, assessment, gap analysis, and reporting.
• - Experience defining, tracking, and reporting Application Security KPIs, metrics, and maturity indicators.
• - Experience developing, updating, and aligning security policies and technical standards with international best practices and local compliance requirements, including NCA requirements.
• - Strong practical experience in Secure Software Development and DevSecOps practices.
• - Proven experience working with CI/CD platforms such as GitLab, Azure DevOps, and/or CloudBees.
• - Strong understanding of integrating security tools into the SDLC, including SAST, SCA, DAST, IAST, Secrets Management, and IaC Scanning.
• - Good knowledge of security frameworks and standards, including:
• - OWASP SAMM
• - OWASP DSOMM
• - OWASP DSOVS
• - BSIMM
• - NIST SSDF
• - NCA Cybersecurity Guidelines
• - Proficiency in automation and scripting using Python, Bash, and/or PowerShell.
• - Strong written and verbal communication skills in English.
• - Arabic language proficiency is an advantage.
• Preferred / Required Professional Certifications
• Candidates must hold at least two (2) certifications or recognized training credentials from the following list:
• - GCSA – GIAC Cloud Security Automation (SANS)
• - GDSA – GIAC Defensible Security Architecture (SANS)
• - DevSecOps Foundation / Professional – DevOps Institute
• - CSSLP – Certified Secure Software Lifecycle Professional (ISC²)
• - GWEB – GIAC Web Application Defender (SANS)
• - OSWE – Offensive Security Web Expert
• - CKS – Certified Kubernetes Security Specialist
• - AZ-400 – Microsoft Azure DevOps Engineer Expert
• - AWS Certified DevOps Engineer – Professional
• - CISSP or CISM
• - Recognized Secure Coding training from organizations such as SANS, Secure Code Warrior, or OWASP
• - Formal training in BSIMM, OWASP SAMM, OWASP DSOMM, OWASP DSOVS, or NIST SSDF

Responsibilities

• Lead initiatives to improve and enhance DevSecOps maturity across the organization.
• Conduct DevSecOps and Application Security maturity assessments against recognized frameworks and standards, including BSIMM 15, OWASP DSOMM, and OWASP DSOVS.
• Assess control coverage, pipeline maturity, security practices, control duplication, and high-risk areas, and identify gaps and improvement opportunities.
• Design, review, and coordinate the integration of security controls into CI/CD pipelines, including SAST, SCA, DAST, IAST, Secrets Management, and Infrastructure as Code (IaC) Scanning.
• Establish and govern vulnerability triage, prioritization, tracking, and remediation processes, including defined SLAs.
• Lead the implementation, configuration, and optimization of application, API, and secure development security tools.
• Develop and maintain technical standards, documentation, security guidelines, templates, checklists, and operational runbooks.
• Lead knowledge transfer activities and provide technical guidance to client teams.
• Provide technical mentorship and guidance to DevSecOps, cybersecurity, and software development teams.
• Monitor and report on Application Security KPIs, metrics, and DevSecOps maturity indicators.
• Support the alignment of security policies and standards with global best practices and applicable local regulatory requirements.
• Promote secure software development practices throughout the Software Development Life Cycle (SDLC).

Skills Required