Job Title: DevSecOps Engineer

Location: Remote

Position Type: Full-time

Immediate joiners preferred

About Us:

Ankr Health is a US-based company with offices in San Francisco, Houston, and Bangalore. We create transformative technologies for clinics and hospitals to improve patient outcomes. Our flagship platform is the # 1 side effect management solution for oncology and surgery.

If generative AI is your thing, know that we were one of the first healthcare companies to partner with, and receive funding from, OpenAI. We have nearly 2 years more experience with LLM than most companies in the world. Learn more at https://ankrhealth.com

We are inviting DevSecOps Engineer to join our global IT team. You will get to work directly with US-based expert developers and experience extraordinary personal growth at Ankr Health.

Responsibilities

1. Collaborate with Cross-Functional Teams: Work with development, operations, and external security teams to develop and implement DevSecOps best practices using Microsoft Teams for communication, OpenProject for project management, and Microsoft SharePoint for documentation.
2. Design Secure CI/CD Pipelines: Design, implement, and maintain secure CI/CD pipelines primarily in AWS using Jenkins Pipelines, Terraform, and Ansible to ensure continuous integration and delivery of software applications. Experience with Zero Downtime deployments.
3. Develop Security Audits for Compliance: Develop and execute security audits for compliance with standards like HIPAA, SOC-1, and SOC-2 using tools similar to Nessus or Qualys for vulnerability assessments, Splunk for audit trail analysis, and Drata for regulatory compliance management.
4. Conduct Regular Security Assessments: Perform regular security assessments and vulnerability scans using tools like OWASP ZAP, Burp Suite, and Tripwire to identify vulnerabilities and implement appropriate remediation measures.
5. Implement Security Controls and Tools: Implement and manage security controls and tools such as AWS Shield, Bitwarden for secrets management.
6. Central Logging Solution: Implement a central logging solution using the Grafana/Prometheus/Loki, or AWS CloudWatch Logs for diverse sets of applications, ensuring comprehensive monitoring and analysis capabilities.
7. Embed Security into Development Lifecycle: Work closely with development teams to embed security practices into the software development lifecycle through secure coding guidelines, SAST tools like SonarQube, and DAST tools such as OWASP ZAP.
8. Consult on DevSecOps Requirements: Consult on DevSecOps requirements from diverse application or line of business partners using a mix of AWS-native tools (e.g., AWS Config) to ensure alignment with organizational goals.
9. Troubleshoot and Fix Problems: Troubleshoot, identify, and resolve issues within the DevSecOps domain using debugging tools.
10. Experience Managing VPN Servers: Have experience managing split VPN tunnels, particularly OpenVPN, to ensure secure remote access and connectivity for teams.
11. Familiarity with Microsoft 365 Cloud Apps: Be familiar with the Microsoft 365 suite of applications (including Teams, SharePoint, OneDrive) to support collaboration, document management, and communication within cloud environments.
12. Ensure Incident Tracking Compliance: Ensure that incident tracking tools (e.g., OpenProject) are updated in accordance with established norms and processes; gather essential data and document any discoveries or concerns systematically.
13. Automate Security Testing Processes: Automate security testing processes using tools like OWASP ZAP for automated scans and integrate them into the CI/CD pipeline using Jenkins or GitHub Actions to ensure continuous security validation.
14. Stay Current with Security Trends: Stay informed about the latest security trends, threats, and technologies through continuous learning via platforms like Pluralsight, Coursera, and participation in relevant webinars and conferences to continuously improve the organization's security posture.

Requirements:

• Education:Bachelor's degree in computer science, engineering, or a related field.
• Experience: Proven 5 to 10-years' experience as a DevSecOps Engineer with a strong portfolio of relevant projects.
• SOC2 experience required
• Comprehensive technical expertise in a variety of DevSecOps toolkits, including Ansible, Jenkins, Artifactory, Jira, Black Duck, Terraform, Git/Version Control Software, or comparable technologies
• In-depth knowledge of cloud platforms and services (e.g., AWS, Azure, GCP).
• Familiarity with security standards and frameworks (e.g., SOC-I, SOC-II, HIPAA, OWASP, NIST, CIS). Recent experience in at least one of these is required, and we will provide training on others.
• Strong background in software development, scripting, and automation.
• Experience with containerization and orchestration tools (e.g., Docker, Kubernetes).
• Hands-on experience with security tools such as static code analysis, dynamic analysis, and vulnerability scanners.
• Excellent communication and collaboration skills, with the ability to work effectively in cross-functional teams.
• Relevant certifications (e.g., CISSP, AWS Certified Security Specialty) are a plus.

Technical Skills:

• DevOps Tools and Technologies: Jenkins, Git, Docker, Kubernetes, Ansible, Terraform, Puppet, Chef, AWS, Azure, GCP
• Security Tools and Technologies: OWASP, Nessus, Burp Suite, Security Onion, SIEM
• Infrastructure as Code (IaC): Terraform, CloudFormation, Ansible
• Cloud Security: AWS Security Groups, Azure Security Center
• Application Security: Secure coding practices, vulnerability scanning, penetration testing
• Incident Response and Forensics: Incident handling, log analysis, digital forensics
• Compliance and Risk Management: GDPR, HIPAA, SOC-I, SOC-II, ISO 27001, NIST
• Collaboration and Communication: Agile, Scrum, Jira, Confluence
• Security Tools: SonarQube, OWASP ZAP, Burp Suite, Nessus
• Monitoring and Logging: ELK Stack, Prometheus, Grafana

Soft Skills:

• Strong problem-solving and analytical skills.
• Excellent communication and teamwork skills.
• Ability to adapt to new technologies and learn quickly.
• Attention to detail (are you reading this? Let us know during the interview!) and a commitment to delivering high-quality work.

Benefits:

• Extremely generous compensation with salary in top decile for your office location
• Opportunities for rapid growth (in title, responsibilities, skills, income)
• And more (discuss during interview)

Does this excite you? Pique your interest? If so, apply now!