1 day ago
Bengaluru, IndiaSenior
Responsibilities
- Integrate security controls, code quality gates, vulnerability detection, secrets scanning, and policy enforcement into Azure DevOps and GitHub workflows.
- Configure and maintain SonarQube, Fortify, Sonatype, Katalon, GitHub, Azure DevOps, and OpenShift capabilities across the DevSecOps toolchain.
- Collaborate with development teams to remediate security findings and improve secure coding practices.
- Establish governance controls, branch protection policies, compliance controls, and secure coding standards.
- Support containerization, image scanning, runtime security, and cloud-native or hybrid security controls in Azure environments.
- Monitor, triage, and respond to vulnerabilities across SDLC tooling and pipelines.
- Plan and execute source-code repository and CI/CD pipeline migrations while preserving history and minimizing disruption.
- Manage tool upgrades, patching, integrations, feature adoption, compatibility, performance, and security posture.
- Develop reusable pipeline templates, automation scripts, and security standards for enterprise adoption.
- Drive DevSecOps maturity, automation, toolchain integration, and compliance with governance and regulatory requirements.
Requirements
- Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent experience.
- At least 5 years of experience in DevOps, DevSecOps, or software engineering.
- Hands-on experience with Azure DevOps, GitHub, CI/CD platforms, repository migrations, and CI/CD pipeline migrations.
- Experience with SonarQube, Fortify, Sonatype, Katalon or similar automated testing frameworks, and application security practices.
- Understanding of secure coding practices and the OWASP Top 10.
- Experience with OpenShift or Kubernetes and cloud environments, preferably Microsoft Azure.
- Proficiency in PowerShell, Python, Bash, or similar scripting or programming languages.
- Preferred experience with GitHub Advanced Security, enterprise governance controls, large-scale DevSecOps transformations, Open Policy Agent, or Azure Policy.
- Preferred security certifications include CISSP, CSSLP, or CEH.
- Knowledge of NIST, ISO 27001, and SOC 2 compliance frameworks is preferred.
Tech Stack
Categories
About KBR, Inc.
KBR, Inc. delivers engineering, technology, and professional services to government and industrial customers, spanning defense, space, sustainability, and energy. Its businesses include long-term government mission support and program management, and Sustainable Technology Solutions that license process technologies and provide consulting and operations support across asset lifecycles. Headquartered in Houston and listed on the NYSE, KBR became an independent public company in 2006 after its separation from Halliburton.