DevSecOps Engineer

Contour Software

. Design, implement, and run the CI/CD security toolchain: SAST, SCA, DAST, container and IaC scanning, secrets detection, SBOM generation, and policy-as-code .

Posted 11/4/2026full-timeKarachi • PakistanSeniorLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in application and cloud security, with a strong focus on DevSecOps practices, CI/CD security toolchain implementation, and vulnerability management. Proficient in AWS security controls, secure coding standards, and compliance frameworks such as PCI DSS, SOC 2, and ISO 27001.

Highest-signal resume keywords

DevSecOps Program AdministrationCI/CD Security Toolchain ImplementationAWS Security FundamentalsTerraform for AWS StackVulnerability Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SASTSCADASTTypeScriptNodeJavaRubyPythonTerraformKubernetes

Soft Skills

Clear CommunicationCollaborationBias to Automate

Tools & Technologies

GitHub ActionsJIRAVeracodeAWSEKSSIEM

Certifications & Qualifications

PCI DSS 4.0SOC 2ISO 27001

Industry Keywords

FintechPaymentsMicroservicesEvent-Driven SystemsNetwork Tokenization

Tech Stack

Tools & technologies

AWSCloudJavaKubernetesMicroservicesNode.jsPythonReactRubyTerraformTypeScript

About the role

Key responsibilities & impact

Design, implement, and run the CI/CD security toolchain: SAST, SCA, DAST, container and IaC scanning, secrets detection, SBOM generation, and policy-as-code
Integrate scanners into GitHub/GitHub Actions pipelines with PR gates and auto-ticketing to JIRA; tune noise, baselines, and break-glass rules
Establish vulnerability management SLAs, risk acceptance workflows, and metrics dashboards
Create secure-coding standards and review checklists for TypeScript/Node, Java, Ruby, and React
Run threat modeling using STRIDE/PASTA and produce DFDs for new and high-risk flows
Lead a security champions program with engineering squads
Harden EKS workloads and implement AWS security controls across IAM, KMS/CloudHSM, network segmentation, WAF/Shield, CloudFront, GuardDuty/Security Hub, and centralized logging
Validate service-to-service authentication, secrets management, and data protection
Manage security certificate adoption across the company technology stack
Map controls and automate evidence for PCI DSS 4.0, SOC 2, and ISO 27001 as needed
Partner with compliance on policies, risk registers, vendor assessments, and control testing
Scope and coordinate internal and third-party penetration tests; plan remediation verification and retests
Contribute to incident response playbooks, tabletop exercises, forensics runbooks, and incident response events
Evaluate and deploy AI/ML security capabilities for code review, alert triage, anomaly detection, and drift detection
Define security KPIs, instrument dashboards, and tune models and policies
Establish AI security guardrails, governance, documentation, and audit trails
Orchestrate AI-assisted enrichment and response across CI/CD, SIEM, ticketing, and chat
Own measurable improvements in vulnerability remediation, detection efficacy, and compliance evidence quality

Requirements

What you’ll need

8–10 years in application/cloud security or DevSecOps for high-availability platforms (fintech/payments ideal)
Hands-on DevSecOps program administration experience with Veracode
Fluent in Terraform for the AWS Stack
Strong CI/CD experience (GitHub Actions preferred) and automation in Python/TypeScript/Bash
Solid AWS security fundamentals: IAM, KMS, CloudTrail, Config, Security Hub, GuardDuty, VPC/LBs, WAF/Shield; Kubernetes/EKS hardening experience
Familiarity with microservices, event-driven systems, and DDD; ability to read code in TypeScript/Java/Ruby and basic ReactJS patterns
Working knowledge of PCI DSS 4.0 control objectives, plus SOC 2/ISO 27001 concepts
Clear communication with engineers and non-technical stakeholders; bias to automate and simplify
Payments domain exposure is a bonus: EMV/3DS, PAN vaulting, network tokenization, P2PE, dispute/chargeback flow

Benefits

Comp & perks

Market-leading Salary
Medical Coverage – Self & Dependents
Parents Medical Coverage
Provident Fund
Employee Performance-based bonuses
Home Internet Subsidy
Conveyance Allowance
Profit Sharing Plan [Tenured Employees Only]
Life Benefit
Child Care Facility
Company Provided Lunch/Dinner
Professional Development Budget
Recreational area for in-house games
Sporadic On-shore training opportunities
Friendly work environment
Leave Encashment