Freelance Senior DevSecOps Engineer

Toloka • European Union, Kazakhstan, Georgia, Armenia, Serbia, GA

16d • Remote

About The Position

Toloka is growing rapidly, adding new platforms and infrastructure across multiple cloud environments. We are hiring a senior, hands-on security engineer to own infrastructure security and vulnerability management: Kubernetes and service-mesh security, cloud hardening, and vulnerability remediation. This is a senior, self-directed role. It requires the ability to define scope and drive execution independently, with ownership of core security tooling and processes from day one.

Requirements

• Production experience hardening cloud infrastructure - IAM, logging, service accounts, network security, on at least one major cloud provider (multi-cloud experience is a plus).
• Kubernetes and container security - service mesh (Cilium, Istio, or similar) and policy-as-code (Kyverno, OPA, or similar).
• Vulnerability-management experience - SCA/SAST tooling and SLA-driven remediation practice.
• Fluency with coding agents - experience using agentic tools for infrastructure-as-code review or investigation work, and verifying their output.
• Ability to work independently at a senior level - defining scope and priorities without detailed direction.
• Clear written and verbal communication - able to run design reviews and communicate risk to engineers and leadership.

Nice To Haves

• Experience securing multi-tenant or multi-identity-domain environments
• Supply-chain security tooling (SBOM, Socket, JFrog, or similar)
• Secure-SDLC or AppSec experience
• Terraform/IaC at scale
• Relevant certifications (e.g. AWS/GCP/Azure security specialties, CKS)

Responsibilities

• Own vulnerability management. Operate and maintain the vulnerability-management platform. Ensure container images are scanned and patched on a defined cadence. Maintain supply-chain scanning tooling and its severity-classification configuration. Define and enforce remediation SLAs.
• Own cloud security across multiple providers. AWS, GCP, and Azure hardening, logging, and service-account governance.
• Own Kubernetes and service-mesh security. Operate the service mesh and maintain the policy-as-code rollout so that policy is enforced automatically.
• Audit and secure infrastructure in newly added environments. Review build pipelines and infrastructure in newer parts of the business as they come online, and remediate findings.
• Contribute to security architecture and design review. Review new integrations and internal systems, including AI agents running in production, for security risk.
• Support workforce and endpoint security. Contribute to VDI and browser-isolation initiatives as the program matures.
• Use agentic tooling in your workflow. Use coding agents for first-pass review of infrastructure-as-code, container configuration, and cloud policy, verifying findings against source configuration before acting on them.

Benefits

• Contract (B2B) collaboration, with a path into a project team if things go well
• Flexible, fully remote schedule (40 hours per week)
• Work at the leading edge of AI development, alongside a dedicated and dynamic team of experts
• Projects with customers that are AI industry leaders and well-known household names
• Friendly community

What This Job Offers

• Career Level: Senior
• Education Level: No Education Listed