DevSecOps Engineer

DevSecOps Engineer at Calm, a startup building a secure corporate messenger on Matrix. Salary $2200-$3600 per month. Remote, full-time. Focus on Kubernetes/PostgreSQL infrastructure, CI/CD, and secure development (SSDLC), SAST/DAST/SCA, risk management.

Startup creating a secure corporate messenger based on Matrix. The role combines DevOps and security practices: responsible for infrastructure, CI/CD, and building secure development processes (SSDLC), managing risks, and helping teams release a secure product quickly and predictably. Not a classic 'security theorist' or pure DevOps role. Expected to both set up a cluster and explain to a developer why a specific vulnerability is critical and how to fix it. DevOps part: - Maintain and develop microservice infrastructure (Kubernetes, PostgreSQL). - Set up and develop CI/CD pipelines, control changes in production. - Find and eliminate causes of application and service failures, work with development team. Security part: - Maintain an up-to-date risk picture of the infrastructure and regularly reassess. - Work with SAST, DAST, SCA: set up coverage, analyze results, prioritize vulnerabilities by exploitability rather than severity from the report. - Manage access rights in the environment (RBAC/ABAC, least privilege), secret management (Vault and analogues). - Implement and support security gateway, coordinate new feature releases with information security. - Expert support for development teams on security: explain the fix, not just create a ticket.

Security: - Understanding of secure development process: where SAST/DAST/SCA stand in the pipeline, how to read their results, distinguish TP from FP. - Experience operating at least one class of tools from SAST/SCA (AppScreener, Semgrep, CodeQL, Trivy, Dependency-Track, etc.), including configuring coverage and working with signal quality. - Basic knowledge of typical vulnerability classes (OWASP Top 10, API Security Top 10) and ability to explain the fix to a developer. - Experience with risk-oriented work: risk description, assessment, tracking closure. DevOps: - Administration of Kubernetes and PostgreSQL. - Setting up CI/CD (GitLab CI, GitHub Actions or similar). - Experience supporting microservice infrastructure in production. - Understanding of observability principles (monitoring, logging, tracing). General: - Confident Russian and English (B1+ for reading documentation). - Experience as DevOps/SRE from 3 years, of which at least 1 year focused on security. - Independence, initiative, ability to build processes from scratch. Nice to have: - Experience with E2EE messengers, Matrix, matrix-rust-sdk. - Familiarity with applied cryptography (AES-GCM, keychain, understanding client-side threats). - Experience with self-hosted CI runners, XcodeGen, SwiftLint (if there is a mobile part). - Experience with AI-assisted development (Claude Code, Cursor) and readiness to implement these processes.

Fully remote work, flexible schedule with asynchronous communication (main overlap by MSK from 10 to 19). Selection process: HR Screening. Interview with CEO / CPO / CHRO and TL DevOps. Possibly, but not required: technical interview with DevOps Lead and IS. Offer. Salary: $2200 - $3600 (discussed based on interview results, payments twice a month).