Senior DevSecOps Engineer
Senior DevSecOps Engineer on JustMarkets Tech's Product Security team: embed and maintain SAST, SCA and secrets scanning in CI/CD pipelines, tune scanners, automate finding triage and ticketing, and keep security controls reliable across an AWS/Linux/containers environment. Remote within Europe; Python/Bash/Go automation.
- Compensation
- Not disclosed
- Location
- Europe
- Work setup
- Remote
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- 3+ years hands-on experience in DevSecOps engineering roles
- Strong understanding of Git workflows and CI/CD pipelines, designing reusable integrations and investigating failed jobs
- Practical experience configuring SAST, SCA and secrets scanning, tuning rules and investigating false positives
- Automation in Python, Bash or Go and integrating systems through APIs
- Experience implementing security checks or policies as code with version control, testing and controlled changes
- Securing and hardening cloud environments with at least one major cloud provider (AWS preferred), incl. automated compliance checks
- Working knowledge of Linux and container-based build environments (permissions, credentials, logs)
- Understanding of application, dependency and exposed-secret risks
- Ability to maintain coverage records, runbooks and reporting from pipeline/scanner data
- Strong problem-solving, communication and collaboration skills with ownership of technical tasks
- English B1, Russian fluent
Nice to have
- Direct experience with GitLab CI/CD security integrations
- Experience with Terraform or Kubernetes security checks
- Software supply-chain security (SBOMs, artifact signing, build provenance)
- Experience integrating DAST or AI-assisted security automation tools
- Experience in fintech, trading, payments or other security-sensitive environments
Full description
We are looking for a Senior DevSecOps Engineer to join our Product Security team and help strengthen security across our software development lifecycle.
In this role, you will design, implement, and maintain security integrations within CI/CD pipelines, automate security workflows, and improve the reliability and effectiveness of security controls.You will work closely with Application Security, Cloud Security, DevOps, Platform, and Engineering teams to ensure that security checks are integrated seamlessly into development workflows, vulnerabilities are identified and addressed efficiently, and developers receive clear, actionable feedback.
This is a hands-on technical role offering the opportunity to influence how security tooling and automation are implemented across our engineering environment.
Responsibilities
Integrate and maintain SAST, SCA and secrets scanning in CI/CD pipelines and developer workflows
Build reusable pipeline integrations and security rules managed as code, including agreed cloud configuration checks with Cloud Security and DevOps. Test changes, plan safe rollouts with pipeline owners and verify that required checks run across the agreed scope
Tune scanner rules and configurations to reduce false positives and give developers useful feedback. Validate changes with AppSec, record exclusions and avoid hiding real risks to keep pipelines green
Troubleshoot failed scans, broken integrations and security-related pipeline failures. Restore controls or escalate blockers promptly, explaining the impact and the action needed
Automate finding collection, duplicate handling, ticket creation and status updates. Ensure validated High pipeline and secrets findings have an owner, action and due date; follow up and escalate unresolved ownership or blockers
Work with AppSec and developers to validate findings, improve remediation guidance and check fixes where needed. Turn recurring problems into reusable checks and workflow improvements
Apply scanner configuration changes within the approved baseline. Recommend new gates, tool changes and exception-handling improvements for approval; escalate pipeline-breaking issues or critical unowned findings to Manager (DevSecOps & Application Security)
Maintain clear coverage records, troubleshooting guides and operational runbooks. Use pipeline and tool data to show missing checks, control failures and outstanding findings, and share knowledge so others can support the integrations
Requirements
At least 3+ years of hands-on experience in DevSecOps engineering roles
Strong understanding of Git workflows and CI/CD pipelines, with the ability to design reusable integrations, investigate failed jobs and assess the impact of changes on software delivery