DevSecOps Engineer

As a DevSecOps Engineer at Floma, your primary responsibilities will include driving the architectural decisions for security controls across our cloud infrastructure, establishing secure development practices, implementing security testing, and maintaining compliance frameworks. You'll be closely collaborating with engineering teams to create a reliable and secure environment, making sure we meet industry standards and protect our innovative technologies.

Floma is seeking a DevSecOps Engineer who has at least 5 years of software development experience with a solid focus on secure development practices and DevOps methodologies. Candidates should have a deep understanding of cloud security architecture, particularly with AWS, and experience in Infrastructure as Code using tools like Terraform. Familiarity with compliance frameworks such as SOC 2 and proficiency in automated security testing within CI/CD pipelines are also essential.

At Floma, we are committed to fostering your career development as a DevSecOps Engineer through ongoing training and mentorship opportunities. You'll be working directly with seasoned professionals including our CTO and co-founder, providing you with valuable insights and experience that can propel your career forward. We also promote a workshop environment where learning from experiences and challenges is encouraged.

In the role of DevSecOps Engineer at Floma, you'll engage with a range of cutting-edge tools and technologies. Your day-to-day activities will involve working with AWS cloud infrastructure and container platforms like Docker and Kubernetes. You'll also use Infrastructure as Code tools such as Terraform or AWS CDK, and modern programming languages, preferably Python, to implement security best practices seamlessly across our tech stack.

Floma stands out as a unique workplace for a DevSecOps Engineer due to our pioneering approach and passion for innovation in the AI marketing space. We offer a dynamic environment where your input is valued, and you can take ownership of your projects. Working alongside ex-Google and ex-Apple engineers, you'll have the chance to push technological boundaries and create groundbreaking solutions in a collaborative culture that thrives on creativity.

DevSecOps integrates security practices within the DevOps process, ensuring security is part of the software development lifecycle. It's crucial because it addresses vulnerabilities early, reduces risks, and fosters a culture of security awareness among teams, ultimately leading to more secure applications and systems.

In discussing my experience with cloud security architectures, I would highlight specific projects where I've worked with AWS, detailing the security measures implemented, such as IAM policies, VPC configurations, and use of encryption in transit and at rest, and the overall impact on enhancing the cloud security posture.

When approaching threat modeling, I follow structured frameworks such as STRIDE or PASTA to identify potential threats. I involve team members early in the process to ensure comprehensive coverage and prioritize threats based on their potential impact to effectively allocate resources for risk mitigation.

To automate security testing in CI/CD pipelines, I implement tools such as static and dynamic analysis tools integrated within the pipeline. This includes using SAST for analyzing source code and DAST for runtime testing, alongside automated checks for dependencies and vulnerabilities to ensure security gates are in place before deployment.

In the event of a post-deployment security vulnerability, I would assess the severity and impact, communicate transparently with stakeholders, and then prioritize the remediation process. This could involve rolling back the deployment, issuing patches, or implementing additional security measures to mitigate risks while ensuring minimal disruption.

I have extensive experience with IaC, utilizing tools like Terraform and AWS CDK to define and manage infrastructure through code. This has allowed me to create reproducible environments, maintain version control over infrastructure changes, and implement security configurations from the outset, streamlining deployments and enhancing security compliance.

I have hands-on experience implementing compliance frameworks, including SOC 2. I focus on conducting regular audits, ensuring that the necessary controls are in place, documenting processes, and training teams to maintain compliance. I also work with cross-functional groups to prepare for audits and demonstrate our adherence to security and privacy requirements.

I stay updated on security threats and trends by following industry leaders, participating in webinars, and engaging in relevant communities. I also dedicate time to continuous learning through courses and certifications, as well as collaborating with peers to discuss emerging threats and best practices.

One challenging security problem I faced was an unexpected data breach in a project. I conducted a root cause analysis, identified loopholes in access controls, and rapidly remediated by tightening access rights and implementing additional monitoring, successfully preventing further incidents while also conducting a security education session for the team.

A successful DevSecOps Engineer should possess strong analytical skills, a proactive security mindset, and effective communication abilities. They should be able to collaborate across teams, embrace an agile approach to security, and apply a blend of technical skills and business acumen to align security initiatives with organizational goals.