Devsecops Engineer

Expires at : 2025-05-19

Remote policy : Full remote

Hostelworld Group, the global hostel-focussed online booking platform, inspires adventurous minds to meet the world and come back with life-changing stories to tell. Our customers are not your average tourists; they crave cultural connection and unique experiences that we make possible by providing an unbeatable selection of hostels in unmissable locations – all in the palm of their hand.

Founded in 1999 and headquartered in Dublin, Hostelworld has a growing, high-calibre team of 230 people within Technology, Product, Global Markets, HR, Finance & Legal, and Marketing Teams across our Dublin, London, Porto, Shanghai, and Sydney offices.

WHAT YOU'LL DO

The DevSecOps Engineer will help ensure that security is not an afterthought, but a critical element integrated into the SDLC and cloud infrastructure. By supporting teams in removing technical debt, automating security processes, and managing compliance, this role directly contributes to reducing the risk of security breaches, ensuring regulatory compliance, and safeguarding the company’s data and reputation. Continuous improvement initiatives will enhance the company's security posture, making the development process more efficient and secure.

Role responsibilities include :

• Security Integration: Embed security throughout the software development lifecycle (SDLC) by working closely with development and operations teams.
• Technical Debt Removal: Identify, prioritize, and work with teams to remove technical debt, especially in relation to security vulnerabilities, legacy systems, and non-optimized configurations.
• Cloud Security (GCP): Manage and secure the GCP environment by implementing best practices in identity and access management (IAM), networking, and data protection.
• Infrastructure as Code (IaC): Develop and maintain secure IaC using tools like Terraform or Google Cloud Deployment Manager. Ensure that IaC meets security standards from the outset.
• Automation & CI/CD Pipelines: Collaborate with development teams to integrate security tools into CI/CD pipelines, automating tasks such as vulnerability scanning, compliance checks, and security testing.
• Monitoring & Incident Response: Set up and manage security monitoring tools, ensuring visibility into GCP resources and workloads. Develop and implement incident response protocols for handling security breaches.
• Compliance and Governance: Ensure compliance with industry regulations, data privacy standards, and internal policies (e.g., PCI-DSS, NIS2). Work with stakeholders to implement and maintain governance frameworks.
• Vulnerability Management: Conduct regular security assessments, including vulnerability scanning, penetration testing, and code reviews, to identify risks and ensure timely remediation.
• Collaboration & Education: Work closely with engineering, product, and operations teams to improve security posture while promoting a collaborative, security-first culture.
• Continuous Improvement: Stay updated on security trends, tools, and best practices to continually improve security processes and educate internal teams.

Main requirements

• Cloud Security: This is a mid-level role so would require 3+ years of experience securing cloud environments.
• CI/CD and Automation: Expertise in integrating security into CI/CD pipelines (e.g., Github Actions, Jenkins, CircleCI, Dependabot) and automating security processes.
• Infrastructure as Code: Proficiency in Terraform, Google Cloud Deployment Manager, or similar tools for managing cloud infrastructure securely.
• Scripting: Strong scripting abilities in Python, Bash, or Go to automate security tasks and workflows.
• Containerization & Kubernetes: Experience securing containers (Docker) and orchestrating them securely using Kubernetes (GKE preferred).
• Vulnerability Management: Experience with vulnerability scanning and management tools such as OWASP ZAP, Snyk, or similar tools for cloud applications.
• Logging and Monitoring: Proficiency with logging and monitoring tools such as GCP, Grafana, ELK Stack (or similar) for security alerting and incident response.
• Fluency in English is a requirement.