RocketHuntSmart job search
Calm
3 hours ago
2,200 – 3,600 USD
per month
Reach out directly about this role
Grade
Middle
Experience
from 3 years
Work Format
Remote
English Level
B1 - Intermediate
By company
AI writes it from your resume. You only have to send it.
Salary: $2200 - $3600 (discussed based on interview results, payments twice a month).
We are a startup creating a secure corporate messenger based on Matrix. We are looking for a DevSecOps Engineer who will combine DevOps and secure development practices: be responsible for infrastructure, CI/CD, and simultaneously build secure software development lifecycle (SSDLC) processes, manage risks, and help teams release a secure product quickly and predictably. This is not a classic "security theorist" role, nor is it pure DevOps. We expect someone who can both set up a cluster and explain to a developer why a specific vulnerability is critical and how to fix it.
What you will be doing: DevOps part: Support and development of microservice infrastructure (Kubernetes, PostgreSQL). Configuration and development of CI/CD pipelines, change control in the production environment. Identifying and eliminating causes of application and service failures, joint problem-solving with the development team.
Security part: Maintaining an up-to-date picture of infrastructure risks and regular reassessment. Working with SAST, DAST, SCA: configuring coverage, analyzing results, prioritizing vulnerabilities based on exploitability, not just report severity. Access control management within the environment (RBAC/ABAC, principle of least privilege), secret management (Vault and similar). Implementing and supporting a security gateway, approving releases of new features from an information security perspective. Expert support for development teams on security issues: explaining fixes, not just creating tickets.
What we expect from you: Security: Understanding of secure development processes: where SAST/DAST/SCA fit in the pipeline, how to read their results, distinguish TP from FP. Experience operating at least one class of tools from SAST/SCA (AppScreener, Semgrep, CodeQL, Trivy, Dependency-Track, etc.), including configuring coverage and working with the quality of findings. Basic knowledge of typical vulnerability classes (OWASP Top 10, API Security Top 10) and the ability to explain fixes to developers. Experience with risk-oriented work: describing risks, assessing them, tracking their closure.
DevOps: Administration of Kubernetes and PostgreSQL. CI/CD configuration (GitLab CI, GitHub Actions, or similar). Experience supporting microservice infrastructure in production. Understanding of observability principles (monitoring, logging, tracing).
General: Proficient in Russian and English (B1+ for reading documentation). At least 3 years of experience as DevOps/SRE, with at least 1 year focused on security. Autonomy, initiative, ability to build processes from scratch.
Will be a plus: Experience with E2EE messengers, Matrix, matrix-rust-sdk. Familiarity with applied cryptography (AES-GCM, keychain, understanding client-side threats). Experience with self-hosted CI runners, XcodeGen, SwiftLint (if there's a mobile component). Experience with AI-assisted development (Claude Code, Cursor) and willingness to implement these processes.
Conditions: Full remote work, flexible schedule with asynchronous communication (main overlap with Moscow time from 10 AM to 7 PM).
Selection Process: HR Screening. Interview with CEO / CPO / CHRO and TL DevOPS. Possibly, but not necessarily: technical interview with DevOps Lead and InfoSec. Offer.
