Almaty
We are looking for a DevSecOps/AppSec Lead who will help build a comprehensive SSDLC process: from requirements and architecture analysis to automated security checks in CI/CD, quality gates, code reviews, and the implementation of modern AppSec tools. The role also includes forming an AppSec team and integrating it into development, review, and critical change support processes.
Key Tasks
- Build SSDLC processes.
- Implement SAST and DAST in the development pipeline. If necessary, consider more advanced approaches - IAST/RASP.
- Implement SCA, including using the already acquired SonarQube module.
- Ensure the configuration of tools: SonarQube, quality gates, and other code quality and security control tools.
- Assemble an AppSec engineer team and integrate it into the review process.
- Implement AppSec analysis at the task formation stage within the "shift left" approach.
- Implement local LLM models in the development pipeline at a practically applicable level.
Key Requirements
- 3+ years of experience in AppSec, DevSecOps, or Application Security.
- Understanding of SSDLC and secure development practices.
- Experience implementing SAST, SCA, DAST, IAST, or similar tools.
- Practical experience with SonarQube or other static analyzers, at the level of writing rules.
- Understanding of GitLab CI CI/CD pipelines.
- Experience configuring quality gates, security gates, and code analysis rules.
- Understanding of OWASP Top 10, ASVS, CWE, CVE, and CVSS.
- Ability to analyze scanner results and distinguish real risks from false positives.
- Experience interacting with development teams.
- Ability to write clear regulations, checklists, and instructions.
Will be a plus
- Experience building an AppSec team from scratch.
- Experience with local LLMs: Ollama, vLLM, llama.cpp, Open WebUI, Code LLM, agent tools.
- Understanding of LLM risks: prompt injection, data leakage, supply chain risks, generation of insecure code.
- Experience implementing RASP/IAST solutions.
- Experience building AppSec and DevSecOps metrics.
Resumes can be sent to the email address: a.almassova@kase.kz
Subject: DevSecOps
