DevSecOps Engineer

Metro Global Solution Center (MGSC) is internal solution partner for METRO, a €31.6 Billion international wholesaler with operations in more than 30 countries. MGSC, location wise is present in Pune (India), Düsseldorf (Germany) and Szczecin (Poland). We provide HR, Finance, IT, Strategy, Branding & Business operations support to 31 countries, speak 24+ languages and process over 18,000 transactions a day.

Responsibilities

Embed application security controls into CI/CD pipelines to provide accurate, actionable, and timely feedback to engineers; Support the investigation, remediation, and validation of application security findings including the management of exceptions and false positives; Conduct targeted code reviews in partnership with engineers and platform teams to identify security issues early and improve coding practices; Implement and maintain security controls, integrations, and automations required to ensure security and privacy by default across applications and their APIs; Perform threat modeling exercises to identify abuse cases, threat actors, and appropriate preventative and detective controls; Participate actively in the engineer community led by METRO Corporate Information Security to define best practices, align way-of-working, prioritize and execute on the needed activities across application and API platforms

Requirements

Security experience in one, or more of the following: Application security experience identifying, investigating, and remediating vulnerabilities across all stages of the SDLC; Hands on experience writing and reviewing code and contributing to developer workflows such as design reviews, planning, and implementation; Proven experience designing, implementing, and improving security tooling and CI/CD integrations, with focus on reducing noise and prioritizing risk; Strong focus on developer experience with the ability to communicate security issues clearly; Familiarity with application architectures, including monolithic and microservice based designs; Solid understanding of frameworks such as OWASP Top 10, SAMM, ASVS, and FIRST principles; Comfort working across one or more programming languages such as Java, C++, Python, JavaScript or similar; Experience with LLMs, AI, and agentic coding platforms such as Github Co-pilot, Gemini, or Claude Code; Proven experience as a security subject-matter expert, mentoring and raising awareness to security mandates