DevSecOps Engineer
Job Description
- Embed application security controls into CI/CD pipelines to provide accurate, actionable, and timely feedback to engineers.
- Support the investigation, remediation, and validation of application security findings including the management of exceptions and false positives.
- Conduct targeted code reviews in partnership with engineers and platform teams to identify security issues early and improve coding practices
- Implement and maintain security controls, integrations, and automations required to ensure security and privacy by default across applications and their APIs.
- Perform threat modeling exercises to identify abuse cases, threat actors, and appropriate preventative and detective controls
- Participate actively in the engineer community led by METRO Corporate Information Security to define best practices, align way-of-working, prioritize and execute on the needed activities across application and API platforms.
Qualifications
Security experience in one, or more of the following:
- Application security experience identifying, investigating, and remediating vulnerabilities across all stages of the SDLC.
- Hands on experience writing and reviewing code and contributing to developer workflows such as design reviews, planning, and implementation.
- Proven experience designing, implementing, and improving security tooling and CI/CD integrations, with focus on reducing noise and prioritizing risk.
- Strong focus on developer experience with the ability to communicate security issues clearly.
- Familiarity with application architectures, including monolithic and microservice based designs.
- Solid understanding of frameworks such as OWASP Top 10, SAMM, ASVS, and FIRST principles
- Comfort working across one or more programming languages such as Java, C++, Python, JavaScript or similar.
And:
- Experience with LLMs, AI, and agentic coding platforms such as Github Co-pilot, Gemini, or Claude Code.
- Proven experience as a security subject-matter expert, mentoring and raising awareness to security mandates.
