Senior DevSecOps Engineer

We are looking for a Senior DevSecOps Engineer to join our Product Security team and help strengthen security across our software development lifecycle.

In this role, you will design, implement, and maintain security integrations within CI/CD pipelines, automate security workflows, and improve the reliability and effectiveness of security controls.You will work closely with Application Security, Cloud Security, DevOps, Platform, and Engineering teams to ensure that security checks are integrated seamlessly into development workflows, vulnerabilities are identified and addressed efficiently, and developers receive clear, actionable feedback. 

This is a hands-on technical role offering the opportunity to influence how security tooling and automation are implemented across our engineering environment.

Responsibilities

• Integrate and maintain SAST, SCA and secrets scanning in CI/CD pipelines and developer workflows
• Build reusable pipeline integrations and security rules managed as code, including agreed cloud configuration checks with Cloud Security and DevOps. Test changes, plan safe rollouts with pipeline owners and verify that required checks run across the agreed scope
• Tune scanner rules and configurations to reduce false positives and give developers useful feedback. Validate changes with AppSec, record exclusions and avoid hiding real risks to keep pipelines green
• Troubleshoot failed scans, broken integrations and security-related pipeline failures. Restore controls or escalate blockers promptly, explaining the impact and the action needed
• Automate finding collection, duplicate handling, ticket creation and status updates. Ensure validated High pipeline and secrets findings have an owner, action and due date; follow up and escalate unresolved ownership or blockers
• Work with AppSec and developers to validate findings, improve remediation guidance and check fixes where needed. Turn recurring problems into reusable checks and workflow improvements
• Apply scanner configuration changes within the approved baseline. Recommend new gates, tool changes and exception-handling improvements for approval; escalate pipeline-breaking issues or critical unowned findings to Manager (DevSecOps & Application Security)
• Maintain clear coverage records, troubleshooting guides and operational runbooks. Use pipeline and tool data to show missing checks, control failures and outstanding findings, and share knowledge so others can support the integrations

Requirements

• At least 3+ years of hands-on experience in DevSecOps engineering roles
• Strong understanding of Git workflows and CI/CD pipelines, with the ability to design reusable integrations, investigate failed jobs and assess the impact of changes on software delivery
• Practical experience configuring static application security testing (SAST), software composition analysis (SCA) and secrets scanning, tuning rules, investigating false positives and routing results to the right teams
• Ability to write, test and maintain automation in a suitable language, such as Python, Bash or Go, and integrate systems through APIs. A specific language is less important than reliable, maintainable integrations
• Experience implementing security checks or policies as code, with version control, testing and controlled changes
• Practical experience securing and hardening cloud environments with at least one major cloud provider (AWS preferred), including automated compliance checks against agreed security requirements
• Working knowledge of Linux and container-based build environments, including permissions, credentials and logs needed to troubleshoot security tooling
• Understanding of common application, dependency and exposed-secret risks; ability to distinguish a tool failure from a security finding and identify when specialist review is needed
• Ability to maintain clear coverage records, operational runbooks and reporting using pipeline, scanner and work-item data
• Strong problem-solving, communication, and collaboration skills, with the ability to take ownership of technical tasks and coordinate with cross-functional teams
• English(В1), Russian (fluent)

Will be a plus

• Direct experience with GitLab CI/CD security integrations
• Experience with Terraform or Kubernetes security checks
• Software supply-chain security, including software bills of materials (SBOMs), artifact signing or build provenance
• Experience integrating dynamic application security testing (DAST), or using AI-assisted tools to improve security automation with appropriate review
• Experience in fintech, trading, payments or other security-sensitive product environments

We offer

• 20 paid vacation days per year
• 10 paid sick leave days per year
• Public holidays as per the company's approved Public holiday list
• Medical budget
• Opportunity to work remotely
• Professional education budget
• Language learning budget
• Wellness budget (gym membership, sports gear and related expenses)

Role mission

Make security checks in software delivery reliable, useful and easy for engineering teams to act on, helping protect JustMarkets products and customer data. As a Senior DevSecOps Engineer in Product Security, you will build and operate CI/CD security integrations, automate finding workflows and implement agreed cloud configuration checks with AppSec, Cloud Security, DevOps and Engineering. You will own technical delivery within approved security baselines, improve developer feedback and escalate critical failures or unresolved risks to the appropriate decision-makers.

Requirements hard skills

- Strong understanding of Git workflows and CI/CD pipelines, with the ability to design reusable integrations, investigate failed jobs and assess the impact of changes on software delivery.
- Practical experience configuring static application security testing (SAST), software composition analysis (SCA) and secrets scanning, tuning rules, investigating false positives and routing results to the right teams.
- Ability to write, test and maintain automation in a suitable language, such as Python, Bash or Go, and integrate systems through APIs. A specific language is less important than reliable, maintainable integrations.
- Experience implementing security checks or policies as code, with version control, testing and controlled changes.
- Practical experience securing and hardening cloud environments with at least one major cloud provider (AWS preferred), including automated compliance checks against agreed security requirements.
- Working knowledge of Linux and container-based build environments, including permissions, credentials and logs needed to troubleshoot security tooling.
- Understanding of common application, dependency and exposed-secret risks; ability to distinguish a tool failure from a security finding and identify when specialist review is needed.
- Ability to maintain clear coverage records, operational runbooks and reporting using pipeline, scanner and work-item data.

Requirements soft skills

- Take ownership of agreed work from implementation through operation, follow-up and resolution or explicit escalation.
- Use evidence to prioritise issues, explain trade-offs and avoid hiding risk to meet delivery targets.
- Collaborate with AppSec, Cloud Security, DevOps, Platform and developers to agree workable solutions and clear responsibilities.
- Communicate clearly in written and spoken English during technical discussions, troubleshooting and documentation.
- Share knowledge and produce documentation that another engineer can use without relying on the original author.

Responsibilities

- Integrate and maintain SAST, SCA and secrets scanning in CI/CD pipelines and developer workflows.
- Build reusable pipeline integrations and security rules managed as code, including agreed cloud configuration checks with Cloud Security and DevOps. Test changes, plan safe rollouts with pipeline owners and verify that required checks run across the agreed scope.
- Tune scanner rules and configurations to reduce false positives and give developers useful feedback. Validate changes with AppSec, record exclusions and avoid hiding real risks to keep pipelines green.
- Troubleshoot failed scans, broken integrations and security-related pipeline failures. Restore controls or escalate blockers promptly, explaining the impact and the action needed.
- Automate finding collection, duplicate handling, ticket creation and status updates. Ensure validated High pipeline and secrets findings have an owner, action and due date; follow up and escalate unresolved ownership or blockers.
- Work with AppSec and developers to validate findings, improve remediation guidance and check fixes where needed. Turn recurring problems into reusable checks and workflow improvements.
- Apply scanner configuration changes within the approved baseline. Recommend new gates, tool changes and exception-handling improvements for approval; escalate pipeline-breaking issues or critical unowned findings to Manager (DevSecOps & Application Security).
- Maintain clear coverage records, troubleshooting guides and operational runbooks. Use pipeline and tool data to show missing checks, control failures and outstanding findings, and share knowledge so others can support the integrations.

Will be a plus

- Direct experience with GitLab CI/CD security integrations.
- Experience with Terraform or Kubernetes security checks.
- Software supply-chain security, including software bills of materials (SBOMs), artifact signing or build provenance.
- Experience integrating dynamic application security testing (DAST), or using AI-assisted tools to improve security automation with appropriate review.
- Experience in fintech, trading, payments or other security-sensitive product environments.