Overview

Position Description

Responsibilities

• Position Title: DevSecOps Engineer
• Manage the security lifecycle of Docker images, including creation, scanning, validation, maintenance, and deployment readiness.
• Ensure the production readiness, maintainability, and security compliance of functional, technical, and editor Docker images.
• Perform regular vulnerability scanning and security assessments of Docker images to identify operating system, application dependency, and package vulnerabilities.
• Analyze vulnerability reports, assess risks, prioritize remediation, and coordinate corrective actions with development and platform teams.
• Build, harden, optimize, and maintain secure Docker images by following container security best practices.
• Implement and maintain security controls within CI/CD pipelines to automate image scanning and compliance checks.
• Establish and enforce Docker image standards, including the use of trusted base images, minimal image layers, non-root users, and secure configurations.
• Manage Docker image repositories and registries, including access controls, image tagging, versioning, and lifecycle management.
• Ensure compliance with organizational security policies, industry standards, and applicable regulatory requirements.
• Monitor security advisories and CVEs, and proactively update or rebuild affected images.
• Implement image signing, provenance verification, and software supply chain security controls where applicable.
• Collaborate with development, DevOps, infrastructure, and cybersecurity teams to resolve container security issues.
• Automate security checks, image validation, and remediation workflows using scripting and DevSecOps tools.
• Maintain technical documentation, security assessment reports, remediation records, and compliance evidence.
• Support production deployments, incident investigations, root cause analysis, and continuous improvement of container security practices.

Qualifications

• Employment Type: Full Time
• Category: Software Development / Engineering
• Position Overview
• We are seeking an experienced DevSecOps Engineer with strong expertise in Docker image security, containerization, vulnerability management, and DevSecOps practices. The primary objective of this role is to ensure the security, production readiness, maintainability, and compliance of functional, technical, and editor Docker images.
• The ideal candidate will be responsible for securing container images throughout their lifecycle, implementing automated security checks, identifying and remediating vulnerabilities, and integrating security practices into CI/CD pipelines. The candidate will work closely with development, infrastructure, platform, and security teams to ensure that container images meet organizational security standards and are reliable for production deployment.
• Bachelor's degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent relevant experience.
• 7–9 years of experience in DevOps, DevSecOps, infrastructure engineering, platform engineering, or container security.
• Strong hands-on experience in Docker, container image management, vulnerability assessment, and security hardening.
• Docker and Containerization: Strong experience building, managing, securing, and maintaining Docker images and containers.
• Docker Image Security: Hands-on experience with image vulnerability scanning, remediation, hardening, and security compliance.
• Vulnerability Management: Knowledge of CVEs, CVSS scoring, vulnerability prioritization, patching, and remediation processes.
• Container Image Hardening: Experience with secure base images, minimal image footprints, non-root execution, secrets management, and least-privilege principles.
• CI/CD Pipelines: Experience integrating security scanning and compliance gates into automated build and deployment pipelines.
• Container Registries: Familiarity with Docker Hub, Harbor, Amazon ECR, Azure Container Registry, or similar image repositories.
• Linux Administration: Strong understanding of Linux operating systems, package management, permissions, and system security.
• Scripting and Automation: Experience with Shell/Bash, Python, or similar scripting languages.
• Security Best Practices: Understanding of container security, access control, secure configuration, and software supply chain security.
• Troubleshooting: Strong analytical skills to investigate security findings, resolve image build issues, and support production readiness.
• Experience with container security tools such as Trivy, Snyk, Grype, Clair, Anchore, or Prisma Cloud.
• Knowledge of Kubernetes security, container orchestration, and workload protection.
• Experience with image signing and verification tools such as Cosign and policy enforcement using admission controls.
• Familiarity with Software Bill of Materials (SBOM), SPDX, CycloneDX, and software supply chain security.
• Knowledge of DevSecOps frameworks and security standards such as CIS Docker Benchmarks, NIST guidance, and OWASP practices.
• Experience with infrastructure-as-code tools such as Terraform, Ansible, or CloudFormation.
• Familiarity with Jenkins, GitLab CI/CD, GitHub Actions, Azure DevOps, or similar automation platforms.
• Experience with private registries, artifact management, image lifecycle policies, and automated image promotion.
• Knowledge of cloud security across AWS, Microsoft Azure, or Google Cloud.
• Familiarity with Open Policy Agent (OPA), Kyverno, or other policy-as-code solutions.
• Experience with vulnerability dashboards, compliance reporting, audit preparation, and security metrics.
• Relevant certifications in Kubernetes, cloud security, Docker, or DevSecOps.