Senior Cloud DevSecOps Engineer

We're looking for a Senior DevSecOps Engineer to help us build and secure cloud infrastructure across AWS and Azure. Appecode is a software engineering company. We're scaling our cloud infrastructure and need a hands-on engineer who can own security automation, harden our pipelines, and make sure everything we ship is secure by default — not as an afterthought. What you'll be doing Build and manage cloud infrastructure on AWS & Azure using Terraform (IaC) Integrate security into CI/CD pipelines (GitHub Actions, Azure DevOps, GitLab CI) — SAST/DAST, container scanning, secret detection, SCA Write and deploy automated policy guardrails using Checkov, Tfsec, OPA/Rego Deploy and harden containerized workloads on Kubernetes (EKS & AKS) Enforce Zero Trust via IAM strategy, RBAC, and secrets management (HashiCorp Vault, Azure Key Vault) Continuously audit cloud posture via AWS Security Hub and Azure Defender against SOC2, ISO 27001, CIS benchmarks Automate vulnerability management workflows (ingest → prioritize → route to Jira) Configure centralized logging and SIEM pipelines for threat hunting Bake EDR agents and scanners into base images (AMIs, Azure Golden Images, container base layers) Act as a bridge between Security and Engineering — provide developer-friendly guidance and reusable Terraform modules / Helm charts Must-haves 3+ years in cloud infrastructure, DevOps, or DevSecOps in production environments Hands-on experience with AWS and/or Azure native security services Terraform — you write modules, not just copy-paste Kubernetes (EKS or AKS) — deployment, hardening, RBAC CI/CD security integration — you've actually wired scanners into pipelines Checkov, Tfsec, or OPA — at least one, hands-on Scripting in Python or Bash Familiarity with SOC2, ISO 27001, or CIS benchmarks Nice to have HashiCorp Vault or Azure Key Vault experience SIEM configuration / log pipeline automation Golden image automation (AMIs, Azure) Experience with AWS Security Hub or Microsoft Defender for Cloud FinTech or regulated industry background Engagement details Type: Contract (hourly or fixed — open to discussion) Hours: Full-time or part-time (30–40 hrs/week preferred) Duration: Long-term Communication: English or Ukrainian — async-friendly, overlap with UTC+2 preferred How to apply Please include in your proposal: A brief description of a security improvement you implemented in a CI/CD pipeline or cloud environment Which IaC security tools you've used (Checkov, Tfsec, OPA, etc.) and in what context Your availability and preferred engagement format