Security Engineer (DevSecOps)

EPAM's security consulting team in Göteborg is expanding to meet a broad range of security challenges for enterprise clients, from securing AI and cloud platforms to DevSecOps. Security only holds when it is part of how software is built, not a check added at the end. This role in Göteborg sits where development and information security meet. You work across engineering, DevOps, infrastructure, risk and compliance teams to make secure ways of working the default. Clients can adopt new technology with confidence only when the platforms underneath it are secure. Responsibilities Provide security expertise and guidance to DevSecOps and enablement teams Define and document security processes and create hardening guides and policies Document and drive the adoption of secure engineering best practices Develop and evolve information security policies Integrate, configure and manage security tools to support DevSecOps ways of working Develop scripts to automate security processes Establish mechanisms and tools for security automation within the software development lifecycle (SDLC) Document the use of security tools and processes Requirements 3+ years of experience in information security 3+ years of experience performing security testing (SAST, SCA, DAST and container security), preferably with Fortify, WebInspect, Fortify SSC, Sonatype Nexus IQ and Prisma Cloud 3+ years of experience embedding security into CI/CD pipelines 3+ years of experience with agile methodologies 3+ years of experience in DevSecOps 2+ years of experience securing containerized environments (Docker, Kubernetes) and virtual machines 2+ years of experience with Azure 2+ years of experience with Azure DevOps and GitHub Scripting skills Good communication skills Nice to have 2+ years of experience securing infrastructure in Azure (preferred) or AWS via automation 2+ years of experience in vulnerability management, risk management or similar 3+ years as a developer Experience implementing security monitoring, logging and alerting Experience with Terraform and Ansible