Microservices Security Specialist.

Microservices Security SpecialistLocation: Centurion, Gauteng (provisional – to be confirmed)Positions Available: 5Salary: Market-relatedEmployment Type: To be confirmedJob OverviewWe are seeking experienced and technically proficient Microservices Security Specialists to design, implement, manage and continuously improve security controls across enterprise microservices architectures, containerised applications and cloud-native environments.The successful candidates will be responsible for securing distributed applications, APIs, containers, Kubernetes environments and service-to-service communications against cybersecurity threats, vulnerabilities and unauthorised access.This role requires strong hands-on expertise in microservices security, API protection, container security, DevSecOps, secure application architecture and cloud-native security technologies.The ideal candidates will have proven experience implementing security controls within enterprise microservices environments, with a strong understanding of secure software development, application security testing, identity management and Zero Trust security principles.Key ResponsibilitiesMicroservices Security Architecture and Implementation Design, implement and maintain security controls across enterprise microservices architectures. Conduct security assessments of distributed applications and microservices environments. Identify and remediate security vulnerabilities within microservices, APIs and supporting infrastructure. Implement secure communication mechanisms between microservices and distributed applications. Apply Zero Trust principles to service-to-service authentication and authorisation. Support the development of secure microservices architecture standards and security design patterns. Conduct threat modelling and security architecture reviews for cloud-native applications. Collaborate with software architects and development teams to implement security-by-design principles. Ensure microservices security controls align with organisational security policies and recognised industry standards. API Security and Service-to-Service Protection Implement and maintain security controls for RESTful APIs, GraphQL APIs and microservices endpoints. Configure secure API authentication and authorisation mechanisms. Implement OAuth 2.0, OpenID Connect, JSON Web Tokens (JWT) and mutual TLS (mTLS). Secure API gateways and manage API access policies. Identify and mitigate common API vulnerabilities, including those outlined in the OWASP API Security Top 10. Implement API rate limiting, request validation and traffic protection mechanisms. Secure service-to-service communications within distributed environments. Monitor API security events and investigate suspicious access patterns. Support API security testing and vulnerability remediation. Container and Kubernetes Security Implement security controls across Docker and Kubernetes environments. Conduct container image vulnerability assessments and security configuration reviews. Secure container registries, runtime environments and orchestration platforms. Configure Kubernetes Role-Based Access Control (RBAC), network policies and workload security controls. Implement secure secrets management and container authentication mechanisms. Monitor container and Kubernetes security events. Identify and remediate misconfigurations within containerised environments. Apply security hardening standards to Kubernetes clusters and workloads. Support container runtime protection and cloud-native threat detection. Collaborate with infrastructure and DevOps teams to maintain secure container platforms. DevSecOps and Secure Software Development Integrate security controls into software development and CI/CD pipelines. Implement automated application security testing within development workflows. Support Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA). Identify vulnerabilities in application code, third-party dependencies and container images. Implement secure coding standards and software supply chain security controls. Support Infrastructure as Code (IaC) security scanning and configuration validation. Collaborate with development teams to remediate security findings. Promote secure software development lifecycle (SSDLC) practices. Support continuous security monitoring and automated compliance checks. Cloud-Native Security and Infrastructure Protection Implement security controls for microservices deployed across Microsoft Azure, AWS or Google Cloud environments. Secure cloud-native application platforms and managed Kubernetes services. Configure network segmentation and secure connectivity between microservices. Implement cloud identity and access management controls. Secure application secrets, cryptographic keys and sensitive configuration information. Support service mesh security implementations. Implement workload identity and secure service authentication. Assess cloud-native infrastructure for vulnerabilities and security misconfigurations. Support security monitoring, logging and incident response within distributed application environments. Security Monitoring, Risk Management and Compliance Monitor microservices and API security events using relevant security monitoring tools. Investigate application security incidents and coordinate remediation activities. Conduct vulnerability assessments and security risk reviews. Maintain security documentation, assessment reports and remediation records. Support security audits and compliance assessments involving cloud-native applications. Implement security controls aligned with ISO 27001, NIST and OWASP guidance. Monitor emerging microservices, container and API security threats. Recommend improvements to application security architecture and operational processes. Provide technical guidance to development, DevOps and infrastructure teams. Minimum Requirements Relevant diploma or degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Information Security or a related discipline. Typically 3–5 years of relevant experience in application security, DevSecOps, cloud-native security or microservices security. Proven hands-on experience implementing security controls within microservices or distributed application environments. Strong understanding of microservices architecture and secure application design principles. Practical experience securing REST APIs and service-to-service communications. Strong knowledge of OAuth 2.0, OpenID Connect, JWT and TLS/mTLS. Experience implementing or assessing security controls within Docker and Kubernetes environments. Understanding of Kubernetes RBAC, network policies, secrets management and container security. Experience with application security testing tools and methodologies. Knowledge of OWASP Top 10 and OWASP API Security Top 10. Experience integrating security controls into CI/CD pipelines. Familiarity with cloud-native platforms such as Microsoft Azure, AWS or Google Cloud. Understanding of secure software development lifecycle and DevSecOps principles. Experience conducting vulnerability assessments and coordinating security remediation. Strong technical troubleshooting, analytical and documentation skills. Technical Skills and CompetenciesMicroservices and Application Security Microservices architecture and distributed systems Secure application architecture Microservices threat modelling Service-to-service authentication and authorisation Zero Trust application security Secure software development lifecycle Application vulnerability assessments Secure coding principles OWASP Top 10 OWASP API Security Top 10 API Security Technologies RESTful API security GraphQL API security OAuth 2.0 OpenID Connect (OIDC) JSON Web Tokens (JWT) Mutual TLS (mTLS) API authentication and authorisation API gateways API rate limiting and request validation API vulnerability testing Experience with platforms such as: Azure API Management AWS API Gateway Kong Gateway Apigee NGINX Other enterprise API management and security solutions Container and Kubernetes Security Docker Kubernetes Kubernetes RBAC Kubernetes Network Policies Container image scanning Container runtime security Kubernetes secrets management Kubernetes security hardening Admission controllers and policy enforcement Container registry security Experience with tools such as: Trivy Aqua Security Prisma Cloud Sysdig Falco Kubescape Other container and Kubernetes security platforms DevSecOps and Application Security Testing Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) Software Composition Analysis (SCA) Infrastructure as Code security scanning CI/CD pipeline security Software supply chain security Dependency vulnerability management Secrets scanning Automated security testing Security policy enforcement Experience with tools such as: SonarQube Checkmarx Fortify Snyk Veracode OWASP ZAP Burp Suite GitHub Advanced Security GitLab Security Cloud-Native Security Microsoft Azure Amazon Web Services (AWS) Google Cloud Platform (GCP) Azure Kubernetes Service (AKS) Amazon Elastic Kubernetes Service (EKS) Google Kubernetes Engine (GKE) Cloud IAM and workload identity Cloud-native network security Secrets and key management Cloud workload protection Service Mesh and Secure Communications Istio Linkerd Envoy Service mesh security Mutual TLS Service identity Traffic encryption Service-to-service authorisation Secure ingress and egress controls Network segmentation Automation and Infrastructure as Code Terraform Kubernetes YAML Helm Dockerfiles GitHub Actions GitLab CI/CD Jenkins Azure DevOps Python Bash PowerShell Security automation and configuration validation Security Monitoring and Incident Response Application security logging Kubernetes audit logging Cloud-native threat detection SIEM integration Container runtime monitoring API security monitoring Vulnerability management Security incident investigation Threat detection and remediation Security Frameworks and Standards OWASP Top 10 OWASP API Security Top 10 OWASP Application Security Verification Standard (ASVS) NIST Secure Software Development Framework (SSDF) NIST Cybersecurity Framework ISO/IEC 27001 CIS Kubernetes Benchmark Zero Trust security architecture Cloud-native security best practices Relevant Certifications (Advantageous)One or more of the following certifications would be beneficial: Certified Kubernetes Security Specialist (CKS) Certified Kubernetes Administrator (CKA) Certified Kubernetes Application Developer (CKAD) Certified Cloud Security Professional (CCSP) Certified Information Systems Security Professional (CISSP) Certified Ethical Hacker (CEH) CompTIA Security+ Microsoft Certified: Azure Security Engineer Associate AWS Certified Security – Specialty Google Cloud Professional Cloud Security Engineer Relevant DevSecOps, application security or cloud-native security certifications Key Personal Attributes Strong analytical and technical problem-solving abilities. Excellent understanding of modern application security threats. Strong attention to detail and security awareness. Ability to identify and remediate complex microservices security vulnerabilities. Proactive approach to secure application development and infrastructure protection. Excellent communication and stakeholder engagement skills. Ability to collaborate effectively with development, DevOps, cloud and cybersecurity teams. Strong organisational and technical documentation skills. Ability to manage multiple security priorities and technical projects. High levels of confidentiality, accountability and professional integrity. Application RequirementsInterested candidates should submit an updated CV clearly detailing their practical microservices security, API security, container security and DevSecOps experience, together with copies of relevant academic qualifications and…