Platform and Security Operations Engineer (DevSecOps)
DevSecOps engineer at First Crypto Exchange, a VARA-licensed OTC broker-dealer in Dubai, owning production infrastructure and security operations: Kubernetes and AWS platforms, Terraform/Terragrunt IaC, GitOps delivery, security monitoring, incident response, and audit/compliance readiness. Hybrid role based in Dubai; relocation considered.
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Contract
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Strong hands-on production Kubernetes experience (cluster upgrades, workload identity, network policies, autoscaling, incident investigation)
- Practical experience with Terraform and Terragrunt for infrastructure provisioning
- Experience with Atlantis or similar tools for managing infrastructure changes
- Hands-on GitOps workflows using Flux, Argo CD, or equivalent
- Deep AWS knowledge: VPC, multi-AZ architecture, KMS, OIDC federation, DNS
- Practical security monitoring and detection engineering experience (alerting, detection rules, false-positive reduction)
- Experience designing secure CI/CD pipelines and software supply chain security controls
- Experience with dependency/container image scanning, artifact signing and verification
- Experience supporting external security/compliance audits (ISO 27001, SOC 2, PCI DSS, HIPAA or equivalent)
- Proven experience operating production systems where failures or breaches cause significant financial/regulatory consequences
- Experience developing incident response procedures, root-cause analysis, and postmortems
- Experience using AI-assisted development tools and critically evaluating generated code
- Strong problem-solving skills, ownership mentality, ability to work independently on critical infrastructure
- English proficiency at C1 level or above
Nice to have
- Experience in cryptocurrency, digital assets, fintech, banking, payments, or regulated financial services
- Familiarity with virtual asset regulatory requirements and compliance expectations of regulated financial institutions
- Experience operating security-critical infrastructure for financial platforms or sensitive financial data
- Experience implementing security controls aligned with multiple compliance frameworks
- Experience with workload security, cloud security posture management, secrets management, IAM
- Experience building security operations processes and on-call rotations in a growing engineering team
Full description
ABOUT FIRST CRYPTO EXCHANGE
First Crypto is a VARA-licensed OTC broker-dealer in Dubai serving individual and institutional clients. We are building our own platform for digital assets and fiat payments, including an OTC desk, web client, and mobile app.
FCE is committed to building a trusted, well-governed exchange, combining robust market infrastructure with strong financial controls, regulatory compliance, and operational transparency.
JOB OVERVIEW
We are looking for a Platform & Security Operations Engineer (DevSecOps) to own and develop our production infrastructure, cloud-native platform, and security operations.
The key objective of this role is to ensure the reliability, scalability, and security of FCE's production environment while strengthening infrastructure automation, security monitoring, incident response, and compliance readiness.
You will work closely with the CTO and a small, experienced engineering team, taking ownership of critical infrastructure and security initiatives in a regulated digital asset environment where reliability and security are essential.
KEY RESPONSIBILITIES
Own and maintain production infrastructure and Kubernetes clusters, ensuring reliability, availability, scalability, and security.
Develop and maintain infrastructure as code using Terraform and Terragrunt, covering networking, data infrastructure, and identity management.
Build, maintain, and improve GitOps workflows and infrastructure delivery processes.
Design and implement security monitoring, including alerts, detection rules, and tuning to reduce false positives.
Develop incident response runbooks and establish on-call procedures.
Respond to production and security incidents, investigate root causes, coordinate remediation, and conduct postmortems.
Improve CI/CD pipelines and strengthen software supply chain security.
Implement security scanning for dependencies and container images, as well as artifact signing and verification.
Establish and maintain infrastructure standards, technical documentation, operational procedures, and security guidelines.
Prepare technical evidence and documentation to support external audits and demonstrate the effectiveness of infrastructure and security controls.
Continuously improve platform security, operational resilience, and incident detection and response capabilities.
Leverage AI-assisted development tools where appropriate, critically reviewing generated code and configurations before deployment.
QUALIFICATIONS & SKILLS
Strong hands-on production experience with Kubernetes, including cluster upgrades, workload identity, network policies, autoscaling, and incident investigation.