DevOps Engineer (security)

About the job The world’s most critical--and at-risk--business applications have been neglected for far too long. Onapsis eliminates this blind spot by providing cybersecurity solutions dedicated to business-critical applications. Onapsis helps nearly 30% of the Forbes Global 100 understand the threats and risks across their SAP and Oracle landscapes, whether running on-premises, in the cloud, or in a hybrid environment. We are looking for self-motivated and enthusiastic DevSecOps Engineer who want to impact cybersecurity by continuing to advance, maintain, and enhance our platform features in Threat Detection & Response, Vulnerability Management, and Compliance Automation. What you will be doing, your legacy: Working closely with leadership, product management, and our Engineering and Operations teams to design and implement security-focused capabilities across the SDLC using Shift-Left-On-Security principles. This role partners with InfoSec, Technical Operations, and Platform Engineering teams to ensure CI/CD frameworks, infrastructure, and automation tooling are secure by design, resilient, and capable of protecting our customers at scale. Key Responsibilities: Security Automation & CI/CD: Embed, maintain, and optimize automated security testing (SAST, DAST, SCA) directly into GitLab CI/CD pipelines. Vulnerability & Patch Management: Perform platform security assessments, verify reported exploits, and support vulnerability remediation activities. Security Compliance: Participate in security audits, provide actionable feedback, and coordinate with engineering teams to meet compliance timelines and regulatory standards. Penetration Testing Enablement: Provision and configure isolated test environments, deploy target application builds, and coordinate secure access requirements for penetration testing activities. Security Operations & Incident Response: Collaborate with cross-functional teams to evaluate security releases, generate compliance reports, and support security monitoring/observability using Grafana, New Relic, or OpenTelemetry. Security Advocacy: Conduct internal software security training and advocate for secure coding standards and DevSecOps best practices across engineering teams. Threat Modeling & Risk Mitigation: Conduct threat modeling exercises for new features and infrastructure changes to identify vulnerabilities before code hits production. Requirements: Cybersecurity Expertise (2+ Years) Hands-on experience implementing Shift-Left-On-Security frameworks within the SDLC. Practical knowledge of application security testing methodologies, specifically SAST, DAST, SCA, and OSS management. Experience conducting Threat Modeling exercises and performing secure code reviews. Awareness of penetration testing (blackbox, whitebox) methods Plus: Knowledge of compliance and auditing standards (ISO 27001/27002, NIST 800-53, PCI DSS, CIS Controls) or active SecOps experience. DevOps & Cloud Infrastructure (1+ Years) Proven experience in DevOps practices utilizing Cloud Technologies (AWS preferred, Azure, GCP) Good understanding of the Software Development Lifecycle ( SDLC ), its phases and how to embed Security in each of them Experience in Version Control tools and CI/CD ( Git/GitLab) , including branching, and pipeline development. Knowledge of containerization and orchestration using Docker and Kubernetes . Linux system administration skills, including networking, access management, and basic troubleshooting skills. Expertise in a scripting language (e.g., Python, Bash ). Plus : Exposure toInfrastructure as Code (IaC), specifically Terraform . Soft Skills Demonstrated effective communication and collaboration across Engineering, Security, SRE, and cross-functional teams to support delivery and operational objectives Experience managing priorities , handling operational pressure, and escalating risks or blockers when needed. Identifies and supports continuous improvement initiatives. Demonstrated analytical thinking