DevSecOps Security Assurance Lead

Security Resource to perform the following:

- Continual penetration testing across production and staging environments.

- Identify, document, and report vulnerabilities and exploit paths.

- Validate remediation efforts and provide retesting.

- Support compliance with regulatory standards (e.g., PCI DSS, ISO 27001)

- Provide threat modelling and risk assessments.

- Collaborate with Dev Ops and security teams to integrate testing into CI/CD pipelines.

• Resource Requirements
• 2–3 experienced security professionals (full-time equivalent) with proven expertise in:
• Dev Sec Ops  implementation and CI/CD pipeline security
• Cloud infrastructure security assessments
• Penetration testing and API security
• Security frameworks and compliance standards
• Dev Sec Ops  Implementation Plan and CI/CD Integration Report.
• Monthly Cloud Security Posture Reports and Remediation Status.
• Quarterly Penetration and API Security Testing Reports.
• Security Posture & Gap Analysis Report (Initial and Final).
• Training sessions and supporting documentation for internal teams.

Services to be Provided

• Dev Sec Ops  Security Methodology Implementation
• Design, develop, and implement Dev Sec Ops  practices across development pipelines.
• Integrate security gates within CI/CD workflows to enforce code quality and compliance.
• Utilize existing or recommended code scanning tools (e.g., Sonar Qube, opentext Fortify) for:
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA)
• Provide documentation and training for Dev Sec Ops  processes to development teams.
• Cloud Security Posture Assessment and Remediation :
• Perform initial and ongoing assessments of security configurations across all cloud subscriptions.
• Identify misconfigurations, insecure practices, and compliance issues.
• Use tools such as Microsoft Defender for Cloud, CSPM or similar.
• Collaborate with internal teams to prioritize and remediate identified issues.
• Track and report remediation progress monthly.
• Continuous Assurance via Penetration Testing and API Security Assessment
• Conduct penetration testing of application services on a quarterly basis or aligned with project milestones.
• Scope to include:

o Web applications

o Cloud-native services

o Public and internal APIs

o Dedicated API Security Assessments to cover: ▪ Authentication and authorization flaws

▪ Lack of rate limiting

▪ OWASP API Security Top 10

• Apply a combination of automated and manual techniques using tools like OWASP ZAP, Postman, and Burp Suite Pro.

Provide detailed findings, including:

• Vulnerability descriptions
• Risk severity (CVSS or equivalent)
• Business impact
• Remediation recommendations
• Proof-of-concept evidence where applicable
• Retest resolved issues to confirm closure and ensure continued resilience.
• Support development teams in triaging, prioritizing, and remediating vulnerabilities.

Security Posture Assessments and Gap Analyses

• Conduct a baseline assessment of the current security posture.
• Perform a gap analysis against relevant frameworks and standards such as:
• ISO 27001
• NIST Cybersecurity Framework
• Develop and deliver a remediation roadmap with clear priorities, timelines, and resource estimates.
• Present assessment outcomes and recommendations to stakeholders.