DevSecOps Engineer

“TBC” is announcing a vacancy for the position of - DevSecOps Engineer

Location: Head Office / Information Security Department Type of employment: Labor contract Work schedule: Full time

Expiration date: 31/10/2026

Company Description We are TBC - a leading financial institution in the region, where a brave and goal-oriented team, we fulfill our mission and simplify people's lives. We set a new standard of service using data analysis, artificial intelligence and digital products. We support you in development, achieving goals and creating your success story - the main thing is to believe.

Job Description We are looking for a motivated DevSecOps Engineer who will help us integrate security into the entire cycle of software creation, delivery and operation. In this position, you will collaborate with Development, DevOps, Platform Engineering, Cloud, Infrastructure, Architecture and Cybersecurity teams. Your goal will be to consider security requirements at an early stage, automate controls and timely detect and reduce vulnerabilities.

Main Responsibilities

• SSDLC: Integrate security controls at all stages of SDLC, consider security requirements from planning and architecture phases, implement Shift Left Security, Security by Design and Security by Default approaches, and support Development and DevOps teams in improving secure development processes and implementing best practices.
• CI/CD Security: Integrate security checks into CI/CD pipelines, implement security controls and Quality Gates at build, test, and deployment stages, assess the security of Service Accounts, Service Principals, Tokens, and other identities used in pipelines, and improve Branch Protection, Pull Request Approval, and Segregation of Duties controls to ensure secure and manageable software development processes.
• Application Security Testing: Implement and manage SAST, DAST, SCA, and Secrets Scanning processes, assess risks related to Open Source component vulnerabilities and licenses, develop Infrastructure as Code (IaC) and Configuration Scanning practices, and verify False Positive results and correctly classify security findings to ensure effective risk management.
• Vulnerability management: Analyze identified vulnerabilities in applications, containers, Cloud, and Kubernetes environments, determine business and technical risk-based priorities, assess exploitability, internet accessibility, and asset criticality, develop Remediation Plans, monitor their implementation progress, and actively participate in Risk Acceptance processes.
• Container security: Assess security controls of Container Images and Registries, examine Kubernetes RBAC, Service Account, Secret, Network Policy, and Workload Security configurations, integrate security requirements into Kubernetes Manifests and Helm Charts, and actively participate in Policy as Code, Admission Control, and security policy implementation and development.
• Software Supply Chain Security: Assess the security of third-party libraries and packages, improve control over software component origin and integrity, participate in implementing and developing SBOM processes, Artifact Signing, and Verification, and mitigate risks related to using untrusted or unapproved components and enhance Supply Chain security.
• Architecture, Automation, and Incident Response: Assess the security of new projects and technological changes and implement Threat Modeling, develop security technical standards, procedures, and guidelines, automate repetitive security tasks, and respond to incidents identified in code, CI/CD pipelines, and IaC configurations, and analyze their root causes.

Qualifications Basic knowledge:

• Knowledge of software development cycle, CI/CD processes, and DevOps practices;
• Experience working with Git-based Source Code Management platforms;
• Understanding of Linux operating system and network technologies;
• Knowledge of Authentication, Authorization, and Identity & Access Management concepts;
• Practical understanding of Docker, Container, and Kubernetes technologies;
• Scripting or programming experience;
• Ability to analyze security findings and effectively communicate with technical teams.

Desirable experience in one of the following areas:

• Cyber Security and Application Security;
• DevOps, Platform Engineering, or Cloud Security;
• Container and Kubernetes Security;
• Vulnerability Management and Security Automation;
• Software Supply Chain Security and Infrastructure as Code;
• Security architecture

Desirable certificates in one of the following areas:

• Cyber Security
• APPSEC
• DevSecOps
• Cloud Security
• Kubernetes
• Container Security
• DevOps
• Automation

Skills

• High problem-solving skills
• Motivated for development and learning new things
• High communication skills with both technical and non-technical people
• Willingness to work with AI tools and modern technologies

Additional Information TBC Bank processes candidate personal data in accordance with the requirements of the Georgian Law on Personal Data Protection to determine the candidate's suitability for the vacancy. The candidate's information may also be processed to determine their suitability for future vacancies. The candidate's information is stored for no more than 3 years. If you do not want further processing of your data and want to change or delete your data, please contact us at the link: Privacy - TBC Bank