Title: Security Engineer / DevSecOps Engineer
About Birlasoft:
Birlasoft, a powerhouse where domain expertise, enterprise solutions, and digital technologies converge to redefine business processes. We take pride in our consultative and design thinking approach, driving societal progress by enabling our customers to run businesses with unmatched efficiency and innovation. As part of the CK Birla Group, a multibillion-dollar enterprise, we boast a 12,500+ professional team committed to upholding the Group's 162-year legacy. Our core values prioritize Diversity, Equity, and Inclusion (DEI) initiatives, along with Corporate Sustainable Responsibility (CSR) activities, demonstrating our dedication to building inclusive and sustainable communities. Join us in shaping a future where technology seamlessly aligns with purpose.
Title: Security Engineer / DevSecOps Engineer
Job Description
Core Security Expertise
• Secure SDLC: Implement and embed security practices across all phases of the software development lifecycle—from design through deployment.
• Threat Modeling: Use frameworks such as STRIDE, DREAD, or PASTA to proactively identify and mitigate architectural and implementation risks.
• Vulnerability Management: Conduct vulnerability assessments using tools like Nessus, Qualys, or OpenVAS and deliver actionable remediation plans.
• Application Security: Strong understanding of OWASP Top 10 risks and hands on experience with SAST, DAST, IAST, and RASP tools.
• Identity & Access Management: Implement IAM principles such as least privilege, RBAC/ABAC, SSO, and MFA.
Development & Automation
• Programming/Scripting: Proficiency in Python, Bash, Go, or JavaScript.
• CI/CD Security: Secure and harden pipeline tools including Jenkins, GitHub Actions, GitLab CI, and Azure DevOps. Integrate automated security testing into CI/CD workflows.
• Infrastructure as Code Security: Experience with Terraform, CloudFormation, and Ansible. Familiarity with security scanners such as Checkov, tfsec, Terrascan, and Policy as Code (OPA/Conftest).
• Container & Orchestration Security: Practical experience securing Docker, Kubernetes, and Helm ecosystems. Exposure to Trivy, Anchore, Falco, and Kyverno.
Cloud & Platform Security
• Cloud Security: Strong understanding of AWS, Azure, or GCP security components (IAM, VPC, KMS, WAF, Secrets Manager). Experience with CSPM or CWPP tools.
• Secrets Management: Hands on experience with Vault, AWS Secrets Manager, SOPS, or equivalent secret management solutions.
Monitoring, Detection & Incident Response
• Security Monitoring & SIEM: Experience using Splunk, ELK, Sentinel, Panther, or Datadog for anomaly detection and alert triage.
• Incident Response & Forensics: Ability to analyze logs, investigate breaches, respond to incidents, and implement long term mitigation.
Governance, Risk & Compliance
• Knowledge of frameworks like NIST, ISO 27001, CIS Benchmarks, SOC 2, and PCI DSS.
Collaboration & Communication
• Ability to work cross functionally with developers, operations teams, and business stakeholders to drive a security first culture.
• Strong documentation and communication skills.
Nice to Have
• Experience with Semarchy xDM or Semarchy deployment workflows—beneficial for teams leveraging Semarchy as part of their application deployment lifecycle. (The platform is used in deployment processes across certain projects, making familiarity a plus.)