Job Description

One of our top clients, a well-established Japanese company currently undergoing a major digital transformation within one of Japan’s most important and globally influential industries, is looking for an experienced DevSecOps Engineer to help build and secure its next-generation DX SaaS platform. This position will play a critical role in integrating security into modern software development processes, strengthening cloud infrastructure security, automating security testing, and establishing secure engineering practices across development teams. You will work closely with Software Engineers, Tech Leads, and Security stakeholders to ensure that applications and infrastructure remain secure without compromising development speed or engineering productivity. Join a new global team driving innovation and making a large societal impact. Why Join? Work-Life Balance: Remote-first within Japan + Flex-time Career Growth: Opportunities to develop expertise in Cloud Security, DevSecOps, and modern engineering practices Bilingual Environment: Diverse, multicultural engineering team Modern Engineering Culture: AI-assisted development, cloud-native technologies, security automation, and continuous improvement Pre-IPO Phase: Join a company undergoing significant digital transformation and organizational growth Global Expansion: The company aims to become a global leader and already has offices in India, Singapore, Indonesia, and Vietnam About the Company This company is one of Japan’s most established and respected enterprises, with over 1,000 employees and a remarkable 400-year history in the construction industry. Despite its long history, the company is investing heavily in digital transformation, cloud technologies, and modern software development. The CEO, who graduated in the United States and is highly committed to innovation, has made a strategic decision to build the company’s first-ever in-house digital and product development organization. To achieve this, he has recruited some of Tokyo’s top technology leaders, including an experienced CTO and CIO. The company is developing a next-generation digital platform designed to transform how the industry operates by connecting data, people, and processes across multiple business functions. As the engineering organization expands, the company is strengthening its security practices to support scalable, reliable, and secure software development. The company also has an international presence, with offices in: India Singapore Indonesia Vietnam Role Overview As a DevSecOps Engineer , you will help establish and maintain a modern security engineering environment by integrating security into every stage of the software development lifecycle. Rather than treating security as a final checkpoint before deployment, you will implement a shift-left security approach , enabling development teams to identify and address vulnerabilities early. You will be responsible for integrating automated security checks into CI/CD pipelines, strengthening cloud and container security, managing software supply chain risks, and supporting secure software development practices. Working closely with engineering teams and the company’s security function, you will help translate security policies into practical technical controls. You will also contribute to improving security practices for AI-assisted development and applications integrating LLM technologies. The ideal candidate combines practical DevOps or software engineering experience with application security knowledge, cloud infrastructure expertise, and a collaborative approach to security. Key Responsibilities DevSecOps & Security Automation Integrate automated security testing into CI/CD pipelines. Implement and maintain security scanning tools, including: Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) Software Composition Analysis (SCA) Secret scanning Container image scanning Automate security checks throughout the software development lifecycle. Help engineering teams identify and resolve vulnerabilities without slowing down development. Establish secure development practices that support continuous delivery. Cloud Infrastructure Security Design, implement, and maintain security controls across cloud environments, particularly AWS. Apply security best practices for Identity and Access Management (IAM), including least-privilege access. Improve cloud network security, encryption, and infrastructure configuration. Implement cloud security monitoring and configuration auditing. Use Cloud Security Posture Management (CSPM) tools to identify and address security misconfigurations. Collaborate with infrastructure and engineering teams to strengthen cloud security. Infrastructure as Code & Security Standards Develop and maintain secure infrastructure configurations using Terraform or similar Infrastructure as Code tools. Implement Policy as Code practices to standardize security controls. Support secure container infrastructure and deployment environments. Establish consistent security configurations across development and production environments. Improve secrets management and credential protection practices. Software Supply Chain Security Implement processes for generating and managing Software Bills of Materials (SBOM). Identify and manage vulnerabilities in third-party libraries and software dependencies. Support secure build processes, artifact signing, and software provenance verification. Improve visibility into software supply chain risks. Help establish security standards for dependencies, containers, and deployment pipelines. Vulnerability Management & Incident Response Identify, assess, prioritize, and support remediation of security vulnerabilities. Collaborate with development teams to investigate and resolve security issues. Monitor vulnerability remediation progress and support SLA-based tracking. Improve logging, monitoring, and alerting capabilities. Support the development of incident response procedures and security exercises. Assist with security audits and compliance activities. Application Security & Secure Development Support engineering teams in implementing secure coding practices. Provide guidance on common web application vulnerabilities, including OWASP Top 10. Participate in threat modeling and security design discussions. Help developers understand security risks and implement appropriate mitigations. Translate security guidelines into practical engineering controls. Promote a collaborative security culture rather than acting as a gatekeeper. AI Security & AI-Assisted Development Use AI coding assistants such as Claude Code, Cursor, GitHub Copilot, or similar tools in daily engineering activities. Review, test, and validate AI-generated code to ensure security and software quality. Explore AI-assisted approaches to vulnerability triage and security log analysis. Identify and mitigate security risks associated with AI-generated code. Support security practices for applications integrating LLMs and AI agents. Help address AI-specific risks such as prompt injection, sensitive information exposure, and insecure AI-generated implementations. Requirements Requirements Professional Experience 3+ years of professional experience in at least one of the following: Infrastructure Engineering Site Reliability Engineering (SRE) DevOps Engineering Web Application Development Experience building and operating systems on cloud platforms such as AWS, Google Cloud, or Microsoft Azure. Experience implementing and maintaining CI/CD pipelines using tools such as GitHub Actions, GitLab CI, or similar solutions. Hands-on experience with Docker and Infrastructure as Code tools such as Terraform. Understanding of common web application vulnerabilities, including OWASP Top 10, and appropriate mitigation strategies. Experience implementing or operating security tools such as vulnerability scanners, SAST, or SCA solutions. AI-Assisted Development Practical experience using AI coding assistants such as Claude Code, Cursor, GitHub Copilot, or similar tools in daily development. Ability to critically review, test, and validate AI-generated code. Understanding of security and quality risks associated with AI-generated software. Ability to apply appropriate security controls and validation processes when using AI-assisted development tools. Security & Engineering Mindset Strong understanding of security principles and secure software development practices. Ability to collaborate effectively with Software Engineers, Infrastructure Engineers, and Security stakeholders. Proactive approach to identifying risks and implementing practical security improvements. Strong problem-solving skills and attention to detail. Collaborative mindset focused on enabling development teams rather than unnecessarily restricting them. Curiosity, integrity, and commitment to continuous improvement. Preferred Qualifications Experience operating Kubernetes environments and implementing security configurations such as Pod Security and Network Policies. Experience with software supply chain security technologies and practices, including SBOM, SLSA, and Sigstore. Experience implementing Policy as Code using OPA, Conftest, or similar tools. Experience with SIEM platforms, security log analysis, SOC operations, or CSIRT activities. Knowledge of security frameworks such as ISO 27001, ISMS, or NIST Cybersecurity Framework. Understanding of AI and LLM application security, including OWASP Top 10 for LLM Applications. Relevant security certifications such as: AWS Certified Security – Specialty Certified Kubernetes Security Specialist (CKS) Registered Information Security Specialist (Japan) Ability to communicate technical topics in English. Japanese language proficiency equivalent to JLPT N2 or higher is a plus, but Japanese is not a mandatory requirement . Candidates currently learning Japanese are also welcome. Benefits Benefits Employment Type: Full-time employee Annual Salary: ¥700,000 – ¥10,000,000 (depending on experience and qualifications) Remote Work: Remote-first within Japan (occasional office attendance may be required) Flexible Working Hours: Yes Core Time: 11:00 AM – 2:00 PM Standard Working Hours: 9:00 AM – 5:30 PM (7.5 working hours per day) Salary Review: Once per year Bonuses: Twice per year (March and September) Holidays: Weekends + Japanese National Holidays Annual Holidays: Approximately 122 days per year Additional Leave: Paid annual leave, summer and year-end holidays, refresh leave, life support leave, and special leave Additional Benefits: Full social insurance coverage Transportation expenses covered Retirement benefit program Employee stock ownership program Annual health examinations Employee welfare benefits Location Tokyo, Japan (Head Office in Shinjuku) Remote-first working arrangement within Japan. Occasional office attendance may be required depending on business or team needs.