We are redirecting you to the source. If you are not redirected in 3 seconds, please click here.

DevSecOps Engineer at TROOP. TROOP is a group meeting planning and travel management platform that helps companies bring teams together for in-person meetings. The experience starts with TROOP’s award-winning Intelligent Destination Recommendations, which use advanced algorithms to help meeting planners pinpoint the perfect meeting destination, considering travel time, climate impact, budget, lodging availability, and safety factors for all attendees. Using TROOP, companies have saved millions in travel costs, employee time, and carbon emissions, making it possible for people to meet and build stronger relationships with their colleagues, clients, and partners, even in times of tightening budgets and travel restrictions.. Why TROOP?. TROOP believes in the power of shared experiences and the unifying impact of in-person meetings. We are on a mission to bring people together by transforming the meeting planning process. At TROOP, we have ambitious goals to be the leading provider of end-to-end meeting planning tools. We started by inventing a completely new way for people to decide where to meet, but for us, the destination is just the beginning. We’re developing more innovative solutions that make it easier than ever to organize and host successful group meeting experiences.. TROOP's Culture?. TROOP is an international, remote-first company. Our colleagues are spread across the globe, with entities in Spain, South Africa, and the United States. Our culture is rooted in an African philosophy called "Ubuntu," which means "I am because we are." It refers to an environment of interdependence through trust. We call ourselves TROOPers, and we are people who seek adventure, challenge the status quo, enjoy innovating, and want to be part of something special. We are doers who roll up our sleeves and get into the details; we own the problem and only stop once it is solved.. TROOP. is hiring a . DevSecOps Engineer. who combines technical expertise with a deep understanding of security, cloud infrastructure, and compliance frameworks. In this role, you will be a critical link between our technical teams, clients, and stakeholders - driving security best practices across the development lifecycle and ensuring our cloud infrastructure meets industry and regulatory compliance standards.. What you’ll be doing:. Security Automation and Infrastructure:. . . Develop and implement automated security testing within CI/CD pipelines, including static analysis, dynamic analysis, and dependency scanning.. . Integrate security tools to automate vulnerability detection, access control, configuration management, and compliance monitoring.. . Continuously improve security policies, processes, and tools, adapting to new threats and changing regulatory requirements.. . Client Interaction & Collaboration:. . . Engage with clients to understand their security requirements, compliance needs, and privacy expectations.. . Facilitate security and compliance discussions with internal teams, clients, and stakeholders to ensure alignment with security goals and objectives.. . Compliance Management:. . . Lead the implementation and management of compliance frameworks.. . Develop and maintain Policy-as-Code to enforce compliance policies within the CI/CD pipeline, ensuring security controls are applied consistently across environments.. . Conduct regular compliance audits, vulnerability assessments, and risk analyses to identify and mitigate potential compliance issues. . . Establish, document, and maintain security policies, including a Written Information Security Program (WISP).. . Collaborate with the Operations team to manage the MDM and strengthen endpoint security policies and posture.. . Bounty Program Oversight:. . . Implement and manage a bug bounty program, serving as the primary point of contact for vulnerability submissions and ethical hacker interactions.. . Triage and prioritize reported vulnerabilities, coordinating with development and security teams for swift remediation.. . Implement feedback loops to integrate insights from bug bounty reports into our security practices, minimizing recurring vulnerabilities.. . Experience & Qualifications:. . . 5-8 years’ in DevSecOps, Security Engineering, or a related role, with a strong background in security practices within the DevOps lifecycle.. . Hands-on experience implementing and managing compliance frameworks via platforms like Vanta.. . Relevant security qualifications (GCP/AWS/Azure).. . Proven experience engaging with clients to understand their security requirements, compliance needs, and privacy expectations, including international (US-based) clients.. . Experience working in fast-paced startup environments.. . Technical Skills:. . . Proficiency in security automation tools, including SAST, DAST, container security, and configuration management.. . Strong knowledge of CI/CD tools (GitLab CI) and infrastructure as code (Terraform).. . Experience with cloud platforms (GCP), containerization technologies (Kubernetes),networking, WAF and threat intelligence platforms (Cloudflare) with a focus on security and compliance.. . Compliance & Legal Knowledge:. . . Familiarity with data privacy and regulations, especially SOC 2 Type 2, and experience in implementing privacy-by-design principles.. . Understanding of bug bounty program management and experience working with external researchers or bounty platforms.. . Ability to translate legal and regulatory requirements into actionable security policies and controls within the DevSecOps environment.. . Soft Skills:. . . Ability to work collaboratively with cross-functional teams, including Engineering, Product, and client-facing teams.. . Excellent communication and interpersonal skills, with the ability to explain complex security concepts in clear, professional English to non-technical stakeholders and clients.. . Strong problem-solving skills with a proactive and solution-oriented mindset.. . Company Location: Spain.