Senior DevSecOps

INFOBUS Holding is an international product IT company in the travel industry. We develop INFOBUS.eu, a platform for booking bus, train, and flight tickets, and BusSystem.eu, a SaaS solution for carriers.
We are looking for a Senior DevSecOps / Security Engineer to build a cybersecurity program around our existing infrastructure: assess risks, implement technical safeguards, establish continuous monitoring, and develop an incident response process. This is a hands-on role covering the full implementation cycle, from assessment and solution design to configuration, deployment, and validation.

Your responsibilities:

• Assess the security of websites, APIs, infrastructure, access controls, and data; develop a risk register and remediation plan aligned with business priorities.
• Design and implement technical security controls, defining how they will be maintained and monitored.
• Configure and maintain Cloudflare, WAF, rate limiting, and bot management rules; investigate suspicious traffic while preserving access for users, partners, and legitimate search engine crawlers.
• Introduce security scanning for code, dependencies, secrets, and running applications; integrate checks into CI/CD, validate findings, and coordinate vulnerability remediation.
• Work with DevOps to strengthen the security of servers, network equipment, cloud services, and databases through access controls, secrets management, logging, and secure configurations.
• Set up security event collection and alerting, develop incident response procedures, participate in investigations, and address root causes to prevent recurring incidents.
• Define endpoint security requirements, including protective tools, updates, and configurations; coordinate implementation with IT support.
• Support technical audit readiness by implementing required security controls and preparing evidence of their operation.
• Document configurations and procedures, train internal specialists, and transfer knowledge to support ongoing maintenance.

• Hands-on experience implementing security solutions independently, from design through production deployment.
• Strong knowledge of Linux, networking, HTTP/HTTPS, TLS, DNS, access management, and server configurations.
• Experience securing cloud and on-premises infrastructure, with the ability to work with GCP.
• Experience with Cloudflare or comparable solutions, including WAF, DDoS protection, bot management, and traffic analysis.
• Experience automating security checks and integrating security tools into CI/CD.
• Understanding of web application, API, database, and personal data storage security.
• Experience analyzing security events and responding to incidents.
• Ability to translate security requirements into specific technical configurations and actionable tasks.
• A proactive, independent approach, with the ability to prioritize business risks, communicate technical issues clearly, and coordinate changes across teams.

• Experience preparing a company for an ISO 27001 audit from a technical perspective.
• Experience implementing technical controls to protect personal data.

• The opportunity to build a comprehensive cybersecurity program for an international product company.
• Influence over security tooling and technical approaches.
• Work across a customer-facing platform, external APIs, a SaaS product, and cloud and on-premises infrastructure.
• Direct collaboration with the CTO and close cooperation with technical and business teams.