DevSecOps & Cloud Security Consultant

Position: DevSecOps & Cloud Security Consultant 5–7+ years’ experience Full-time onsite Initial 1 year Location: Muscat 1. Job description (JD) The DevSecOps & Cloud Security Consultant will perform security assessments of DevSecOps pipelines, cloud infrastructure, Kubernetes environments and application delivery processes. The consultant will review CI/CD security, Infrastructure as Code (IaC), Helm charts, source code, cloud configurations and security policies; identify vulnerabilities and misconfigurations; automate security controls; and support security tool evaluation and implementation. Key responsibilities • Assess and strengthen security across CI/CD pipelines and DevSecOps workflows. • Review Infrastructure as Code (IaC) templates for insecure configurations, excessive permissions, hardcoded credentials and exposed secrets. • Conduct manual and automated security reviews of Kubernetes Helm charts. • Perform source code security reviews using Static Application Security Testing (SAST). • Assess cloud security configurations, identity and access management (IAM), network controls, encryption and logging. • Review Kubernetes security controls and container deployment configurations. • Implement or validate security automation and policy enforcement using OPA/Gatekeeper. • Support vulnerability management, risk assessment, remediation tracking and revalidation. • Evaluate security tools and conduct POCs across cloud, application, container, API and DevSecOps security. • Prepare assessment findings, risk ratings, remediation recommendations and technical reports. • Coordinate with development, infrastructure, cloud and Information Security teams. 2. Mandatory technical skills The following skills are explicitly identified in the RFP's Resource 2 profile. Skill area Required expertise DevSecOps security Security integration throughout software development and deployment workflows CI/CD security Pipeline security reviews, automated testing integration and secure delivery processes Infrastructure as Code (IaC) Reviewing infrastructure templates for security risks and misconfigurations Helm chart security Reviewing deployment charts, Kubernetes security settings and secure deployment practices Source code review (SAST) Static analysis and identification of insecure coding practices and vulnerabilities Cloud security Cloud configuration reviews, IAM controls, network security, encryption and logging Kubernetes security Kubernetes environments, access controls, workloads, configurations and security baselines Vulnerability management Vulnerability identification, validation, prioritisation, remediation tracking and retesting Security automation Automating security checks and integrating security controls into delivery workflows Policy enforcement OPA/Gatekeeper policy validation, compliance enforcement and deployment controls Security tool evaluation Assessing security tools, conducting POCs and documenting findings and recommendations 3. Experience requirements • Overall experience: 5–7+ years in DevSecOps and cloud security. • Hands-on experience securing CI/CD pipelines and software delivery workflows. • Experience reviewing IaC templates, Helm charts and source code. • Experience with cloud security configurations and Kubernetes environments. • Practical knowledge of vulnerability management and security automation. • Experience implementing or validating policy enforcement using OPA/Gatekeeper. • Experience evaluating security tools and supporting POC activities. 4. Qualifications and certifications Graduate with below certifications will be preferred. • CEH — Certified Ethical Hacker • CISSP — Certified Information Systems Security Professional • OSCP — Offensive Security Certified Professional • CISA — Certified Information Systems Auditor • CISM — Certified Information Security Manager Show more Show less