DevSecOps Engineer

for the Calm team

We are a startup creating a secure corporate messenger based on Matrix. We are looking for a DevSecOps Engineer who will combine DevOps and development security practices: be responsible for infrastructure, CI/CD, and at the same time build secure development lifecycle (SSDLC) processes, manage risks, and help teams release a protected product quickly and predictably.

This is not a classic "security theorist" role, nor is it pure DevOps. We expect someone who can both set up a cluster and explain to a developer why a particular vulnerability is critical and how to fix it.

Responsibilities: DevOps Part: • Support and development of microservice infrastructure (Kubernetes, PostgreSQL). • Configuration and development of CI/CD pipelines, control of changes in the production environment. • Identifying and eliminating the causes of application and service failures, collaborative solution development with the development team.

Security Part: • Maintaining an up-to-date picture of infrastructure risks and regular reassessment. • Working with SAST, DAST, SCA: configuring coverage, analyzing results, prioritizing vulnerabilities by exploitability rather than by report severity. • Access control management within the environment (RBAC/ABAC, principle of least privilege), secret management (Vault and similar). • Implementation and support of security gateways, approval of new feature releases from an information security perspective. • Expert support for development teams on security issues: explaining the fix, not just creating a ticket.

We expect from you: Security: • Understanding of the secure development process: where SAST/DAST/SCA are placed in the pipeline, how to read their results, distinguish TP from FP. • Experience with at least one class of tools from SAST/SCA (AppScreener, Semgrep, CodeQL, Trivy, Dependency-Track, etc.), including configuring coverage and working with the quality of findings. • Basic knowledge of typical vulnerability classes (OWASP Top 10, API Security Top 10) and the ability to explain the fix to a developer. • Experience in risk-oriented work: describing risks, assessing them, tracking their closure.

DevOps: • Administration of Kubernetes and PostgreSQL. • CI/CD configuration (GitLab CI, GitHub Actions, or similar). • Experience in supporting microservice infrastructure in production. • Understanding of observability principles (monitoring, logging, tracing). General: • Proficient in Russian and English (B1+ for reading documentation). • At least 3 years of experience as a DevOps/SRE, with at least 1 year focused on security. • Independence, initiative, ability to build processes from scratch. Would be a plus: • Experience with E2EE messengers, Matrix, matrix-rust-sdk. • Familiarity with applied cryptography (AES-GCM, keychain, understanding client-side threats). • Experience with self-hosted CI runners, XcodeGen, SwiftLint (if there is a mobile component). • Experience with AI-assisted development (Claude Code, Cursor) and willingness to implement these processes.

Conditions: • Full remote work, flexible schedule with asynchronous communication (main overlap with Moscow time from 10 AM to 7 PM). • Salary: 2200 - 3600 (negotiable based on interview results, payments twice a month in dollars). • Minimum bureaucracy, direct impact on architecture and processes. • Opportunity to build a security culture in a growing startup.

Selection Process: • HR Screening. • Interview with CEO / CPO / CHRO and DevOps TL. Potentially, but not necessarily: technical interview with DevOps Lead and Information Security. • Offer.