METRO/MAKRO

Wholesale food for HoReCa and traders

DevSecOps Engineer

Security Engineering & ArchitectureConfirmed live in the last 24 hours

Full-timePune, Maharashtra, IndiaNo salary listedIn-person

About the Job

Requirements

Application security experience identifying, investigating, and remediating vulnerabilities across all stages of the software development life cycle.
Hands-on experience writing and reviewing code and contributing to developer workflows such as design reviews, planning, and implementation.
Proven experience designing, implementing, and improving security tooling and continuous integration and continuous delivery integrations, with a focus on reducing noise and prioritizing risk.
Ability to communicate security issues clearly with a strong focus on developer experience.
Familiarity with application architectures, including monolithic and microservice-based designs.
Solid understanding of the Open Worldwide Application Security Project Top 10, Software Assurance Maturity Model, Application Security Verification Standard, and Forum of Incident Response and Security Teams principles.
Comfort working across one or more programming languages such as Java, C++, Python, or JavaScript, or similar.
Experience with large language models, artificial intelligence, and agentic coding platforms such as GitHub Copilot, Gemini, or Claude Code.
Proven experience as a security subject-matter expert.

Responsibilities

Embed application security controls into continuous integration and continuous delivery pipelines to provide accurate, actionable, and timely feedback to engineers.
Support the investigation, remediation, and validation of application security findings, including the management of exceptions and false positives.
Conduct targeted code reviews in partnership with engineers and platform teams to identify security issues early and improve coding practices.
Implement and maintain security controls, integrations, and automations required to ensure security and privacy by default across applications and their application programming interfaces.
Perform threat-modeling exercises to identify abuse cases, threat actors, and appropriate preventive and detective controls.
Participate in the engineer community led by METRO Corporate Information Security to define best practices, align ways of working, prioritize activities, and execute needed work across application and application programming interface platforms.
Mentor others and raise awareness of security mandates.

Job Description

Embed application security controls into CI/CD pipelines to provide accurate, actionable, and timely feedback to engineers.
Support the investigation, remediation, and validation of application security findings including the management of exceptions and false positives.
Conduct targeted code reviews in partnership with engineers and platform teams to identify security issues early and improve coding practices
Implement and maintain security controls, integrations, and automations required to ensure security and privacy by default across applications and their APIs.
Perform threat modeling exercises to identify abuse cases, threat actors, and appropriate preventative and detective controls
Participate actively in the engineer community led by METRO Corporate Information Security to define best practices, align way-of-working, prioritize and execute on the needed activities across application and API platforms.

Qualifications

Security experience in one, or more of the following:

Application security experience identifying, investigating, and remediating vulnerabilities across all stages of the SDLC.
Hands on experience writing and reviewing code and contributing to developer workflows such as design reviews, planning, and implementation.
Proven experience designing, implementing, and improving security tooling and CI/CD integrations, with focus on reducing noise and prioritizing risk.
Strong focus on developer experience with the ability to communicate security issues clearly.
Familiarity with application architectures, including monolithic and microservice based designs.
Solid understanding of frameworks such as OWASP Top 10, SAMM, ASVS, and FIRST principles
Comfort working across one or more programming languages such as Java, C++, Python, JavaScript or similar.

And:

Experience with LLMs, AI, and agentic coding platforms such as Github Co-pilot, Gemini, or Claude Code.
Proven experience as a security subject-matter expert, mentoring and raising awareness to security mandates.

Additional Information

About the Company

METRO/MAKRO

Wholesale food for HoReCa and traders

METRO supplies food and related products to professionals, including hotels, restaurants, caterers (HoReCa) and independent traders, through large physical stores and a delivery network. Its product access combines in-store shopping with Food Service Distribution (FSD) and a digitally connected experience, plus METRO MARKETS, an international online marketplace for professional customers that has grown since 2019. The company’s approach extends across more than 30 countries and relies on a multichannel model to reach about 15 million customers, supported by a workforce of over 85,000 and a 2023/24 sales figure of €31 billion. METRO prioritizes sustainability and reports recognition from indices like MSCI, Sustainalytics and CDP. The goal is to meet professional customers’ needs with reliable, scale-enabled wholesale distribution and digital marketplaces that enable efficient purchasing while expanding international reach.

Company size: 501-1,000
Company stage: Not listed
Total funding: Not listed
Headquarters: Düsseldorf, Germany
Founded: 1964

Recently Posted Jobs

Explore more opportunities at METRO/MAKRO

See more jobs