Senior DevSecOps Engineer

Description

The company is hiring a Senior DevSecOps Engineer for its Product Security team to help improve security across the software development lifecycle.

You will build, run, and upkeep security checks inside CI/CD pipelines, automate security processes, and make security controls more dependable and useful. You will partner with Application Security, Cloud Security, DevOps, Platform, and Engineering so checks fit smoothly into how developers work, issues get found and fixed quickly, and developers get feedback they can act on.

This is a hands-on engineering role where you can shape the security tools and automation used across the engineering environment.

Responsibilities

• Set up and maintain SAST, SCA, and secrets scanning in CI/CD pipelines and developer workflows
• Create reusable pipeline integrations and security rules stored as code, including agreed cloud configuration checks with Cloud Security and DevOps
• Test changes, plan safe rollouts with pipeline owners, and confirm required checks run across the agreed scope
• Adjust scanner rules and settings to cut false positives and make developer feedback more useful
• Validate tuning changes with AppSec and record every exclusion, without hiding real risks just to keep pipelines passing
• Diagnose failed scans, broken integrations, and security-related pipeline failures
• Restore controls quickly, or escalate blockers promptly with a clear explanation of the impact and the action required
• Automate collection and deduplication of findings, ticket creation, and status updates
• Make sure every validated High pipeline or secrets finding has an owner, an action, and a due date, and follow up or escalate where ownership or progress is missing
• Work with AppSec and developers to confirm findings, improve remediation guidance, and verify fixes where needed
• Convert recurring problems into reusable checks and workflow improvements
• Apply scanner configuration changes within the approved baseline
• Propose new gates, tool changes, and better exception handling for approval, and escalate pipeline-breaking issues or critical unowned findings to the Manager (DevSecOps & Application Security)
• Keep coverage records, troubleshooting guides, and operational runbooks up to date
• Use pipeline and tool data to expose missing checks, control failures, and open findings, and share knowledge so others can support the integrations

Requirements

• 3+ years of hands-on experience in DevSecOps engineering
• Solid grasp of Git workflows and CI/CD pipelines, including designing reusable integrations, investigating failed jobs, and judging how changes affect delivery
• Hands-on experience setting up SAST, SCA, and secrets scanning, tuning rules, investigating false positives, and routing results to the right teams
• Ability to write, test, and maintain automation in a language such as Python, Bash, or Go, and to connect systems through APIs; the specific language matters less than building integrations that are reliable and easy to maintain
• Experience putting security checks or policies into code, with version control, testing, and controlled change
• Practical experience securing and hardening cloud environments on at least one major provider (AWS preferred), including automated compliance checks against agreed requirements
• Working knowledge of Linux and container-based build environments, including permissions, credentials, and logs needed to troubleshoot security tools
• Understanding of common application, dependency, and exposed-secret risks, and the ability to tell a tool fault from a real finding and know when a specialist should review
• Ability to keep clear coverage records, runbooks, and reports built from pipeline, scanner, and work-item data
• Strong problem-solving, communication, and teamwork skills, with ownership of technical tasks and the ability to coordinate across teams
• English at B1 level and fluent Russian
• Plus: direct experience with GitLab CI/CD security integrations
• Plus: experience with Terraform or Kubernetes security checks
• Plus: software supply-chain security, including SBOMs, artifact signing, or build provenance
• Plus: experience integrating DAST, or using AI-assisted tools to improve security automation with proper review
• Plus: experience in fintech, trading, payments, or other security-sensitive product environments

Conditions

Remote work is possible

Benefits

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as set out in the company's approved Public holiday list
• Medical budget
• Option to work remotely
• Professional education budget
• Language learning budget
• Wellness budget covering gym membership, sports gear, and related costs