DevSecOps Engineer

Inclusion without Exception

Tata Consultancy Services (TCS) is an equal opportunity employer, and embraces diversity in race, nationality, ethnicity, gender, age, physical ability, neurodiversity, and sexual orientation, to create a workforce that reflects the societies we operate in. Our continued commitment to Culture and Diversity is reflected in our people stories across our workforce and implemented through equitable workplace policies and processes.

Tata Consultancy Services (BSE: 532540, NSE: TCS) is the technology partner of choice for industry-leading organizations worldwide. Since its inception in 1968, TCS has upheld the highest standards of innovation, engineering excellence and customer service.

It has set an aspiration to become the world's largest AI-led technology services company and is enabling its clients to transform themselves across the full AI stack, from infrastructure to intelligence.

Rooted in the heritage of the Tata Group, TCS is focused on creating long term value for its clients, its investors, its employees, and the community at large. With a highly skilled workforce spread across 56 countries and 194 service delivery centers across the world, the company has been recognized as a top employer in six continents. With the ability to rapidly apply and scale new technologies, the company has built long term partnerships with its clients. Many of these relationships have endured into decades and navigated every technology cycle, from mainframes in the 1970s to artificial intelligence today.

Role Description

Implement and manage Application Security Posture Management (ASPM) practices across enterprise applications. Administer and optimize Veracode for Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and security policy management. Integrate security scanning tools into CI/CD pipelines (Azure DevOps, GitHub, Jenkins, GitLab).Perform application security assessments, vulnerability triage, risk analysis, and remediation tracking. Establish secure coding standards and provide guidance to development teams on vulnerability remediation. Monitor application security metrics, compliance dashboards, and posture management reports. Drive vulnerability management activities, including risk prioritization, exception handling, and remediation governance. Collaborate with architects and engineering teams to embed security controls throughout the SDLC.  Support compliance requirements aligned with OWASP Top 10, NIST, CIS Controls, ISO 27001, and industry regulations. Automate security processes using scripting and Infrastructure-as-Code (IaC) security practices.

We are seeking an experienced DevSecOps Engineer to drive secure software development practices and strengthen the organizations Application Security Posture Management (ASPM) capabilities. The candidate will be responsible for integrating security across the SDLC, managing application security assessments using Veracode, automating security controls within CI/CD pipelines, and collaborating with development, infrastructure, and security teams to remediate vulnerabilities and improve overall security posture

.
Required Skills & Qualifications

 years of experience in DevSecOps, Application Security, or Secure SDLC.  Strong hands-on experience with Veracode (SAST, DAST, SCA, Policy Scanning).Experience with Application Security Posture Management (ASPM) platforms and vulnerability management processes. Knowledge of OWASP Top 10, secure coding practices, and threat modelling. Experience integrating security tools within Azure DevOps, GitHub Actions, Jenkins, GitLab CI/CD.  Proficiency in scripting languages such as Python, PowerShell, Bash.  Experience with container security (Docker, Kubernetes) and cloud security (Azure/AWS/GCP).Familiarity with dependency scanning, secrets scanning, and Infrastructure-as-Code security tools.  Strong analytical, troubleshooting, and stakeholder communication skills Preferred Qualifications Certifications such as CSSLP, CISSP, CEH, Azure Security Engineer (AZ-500), GIAC, or Veracode certifications.  Experience with tools such as SonarQube, Checkmarx, Fortify, Snyk, Prisma Cloud, or Microsoft Defender for Cloud.  Knowledge of threat intelligence and security monitoring practices. One-Line Skill Set Summary Application Security | Veracode | ASPM | SAST/DAST/SCA | Secure SDLC | CI/CD Security | Azure DevOps | OWASP | Vulnerability Management | Cloud & Container Security.

TCS does not use artificial intelligence tools for candidate screening or evaluation. This post is for a current vacancy. The hiring process includes an initial screening, followed by a technical evaluation and managerial discussion.

Tata Consultancy Services Canada Inc. is committed to meeting the accessibility needs of all individuals in accordance with the Accessibility for Ontarians with Disabilities Act (AODA) and the Ontario Human Rights Code (OHRC). Should you require accommodation during the recruitment and selection process, please inform Human Resources.

Thank you for your interest in TCS. Candidates that meet the qualifications for this position will be contacted within a 2-week period. We invite you to continue to apply for other opportunities that match your profile.