Lead DevSecOps Engineer

We are looking for a seasoned Lead DevSecOps Engineer to lead the embedding of security practices into our development and deployment pipelines. In this position, you will architect and roll out secure CI/CD workflows, spearhead vulnerability management efforts, and promote a security-first mindset across engineering teams. Please note that this role requires 3 days of work in the office. Responsibilities Lead the design and rollout of DevSecOps practices across development and deployment pipelines Integrate SAST and DAST tools into the CI/CD toolchain to enable continuous security validation Develop and maintain SBOM frameworks that support software transparency and compliance Drive software supply chain security initiatives to protect the end-to-end delivery lifecycle Build security integrations, pipeline automation, and tooling for secure CI/CD workflows via scripting languages Operate and fine-tune vulnerability scanning tools to detect, triage, and remediate security risks Apply industry-recognized security frameworks to inform threat modeling and risk mitigation Collaborate with cross-functional teams to embed security best practices into product development Mentor engineers in secure coding, automation, and modern DevSecOps methodologies Requirements 7-14 years of experience in DevSecOps and product cybersecurity environments Knowledge of SBOM frameworks and their related toolchains Background in software supply chain security Expertise in vulnerability scanning tools Proficiency in embedding SAST and DAST into CI/CD toolchains Skills in scripting and automation with Python, Bash, or similar languages for security integrations and pipeline automation Showcase of hands-on experience with tools like Black Duck, Trivy, and SonarQube, or Nexus and comparable solutions Familiarity with security frameworks like OWASP Top 10 and MITRE ATT&CK or similar Competency in AWS Proficiency in English at an Upper-Intermediate level (B2) or above Nice to have Background in regulated sectors such as automotive, industrial, or IoT Expertise in container security and Kubernetes environments Understanding of security monitoring and logging tools like SIEM or centralized logging platforms India Opportunity to work on technical challenges that may impact across geographies Vast opportunities for self-development: online university, knowledge sharing opportunities globally, learning opportunities through external certifications Opportunity to share your ideas on international platforms Sponsored Tech Talks & Hackathons Unlimited access to LinkedIn learning solutions Possibility to relocate to any EPAM office for short and long-term projects Focused individual development Benefit package: Health benefits Retirement benefits Paid time off Flexible benefits Forums to explore beyond work passion (CSR, photography, painting, sports, etc.)