Location: Winnipeg, MB

The DevSecOps Engineer will be responsible for ensuring the security and compliance of the WCB's software development pipeline. The DevSecOps Engineer will work closely with development teams to identify security risks and vulnerabilities, implement security controls and best practices, and integrate security testi ng into the CI/CD pipeline. The DevSecOps Engineer will play a key role in supporting the organization's overall security posture by collaborating with security teams to ensure that security requirements are met throughout the software development lifecycle.

Key Responsibilities

• Identify security risks and vulnerabilities in software development processes and pipelines;
• Implement security controls and best practices to ensure the confidentiality, integrity, and availability of data and systems;
• Integrate security testing into the CI/CD pipeline and collaborate with development teams to remediate vulnerabilities;
• Collaborate with security teams to ensure that security requirements are met throughout the software development lifecycle;
• Automate security testing and compliance processes;
• Ensure compliance with regulatory and industry standards such as PCI DSS, HIPAA, and GDPR; and
• Stay up-to-date with security threats and vulnerabilities, and recommend changes to the organization's security strategy and technology stack as needed.

Minimum Relevant Experience

• Five (5) years of relevant work experience in DevSecOps, security engineering, or related fields.

Preferred Skills

• DevOps methodologies and tools such as Jenkins, CircleCI, GitLab, or Azure DevOps;
• Security best practices, tools, and standards such as OWASP, SANS Top 20, CIS Controls, and NIST Cybersecurity Framework;
• Security testing tools such as SonarQube, Fortify, Veracode, or Black Duck;
• Infrastructure as code (IaC) tools such as Terraform, Ansible, or Puppet;
• Scripting languages such as Python, PowerShell, or Bash; and
• Experience with cloud platforms such as Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP) may be considered an asset.

In addition to the technical sk ills required for the role, the DevSecOps Engineer should possess strong communication, collaboration, and project management skills. The DevSecOps Engineer will be responsible for working closely with development teams and security teams to ensure that security requirements are met throughout the software development lifecycle. The DevSecOps Engineer will have a proven track record of implementing security controls and best practices in a DevOps environment.