Companies in this catalog do not charge applicants. Never send money to apply.
Microservices Security Specialist
Location: Centurion, Gauteng (provisional – to be confirmed)
Positions Available: 5
Salary: Market-related
Employment Type: To be confirmed
Job Overview
We are seeking experienced and technically proficient Microservices Security Specialists to design, implement, manage and continuously improve security controls across enterprise microservices architectures, containerised applications and cloud-native environments.
The successful candidates will be responsible for securing distributed applications, APIs, containers, Kubernetes environments and service-to-service communications against cybersecurity threats, vulnerabilities and unauthorised access.
This role requires strong hands-on expertise in microservices security, API protection, container security, DevSecOps, secure application architecture and cloud-native security technologies.
The ideal candidates will have proven experience implementing security controls within enterprise microservices environments, with a strong understanding of secure software development, application security testing, identity management and Zero Trust security principles.
Key Responsibilities
Microservices Security Architecture and Implementation
Design, implement and maintain security controls across enterprise microservices architectures.
Conduct security assessments of distributed applications and microservices environments.
Identify and remediate security vulnerabilities within microservices, APIs and supporting infrastructure.
Implement secure communication mechanisms between microservices and distributed applications.
Apply Zero Trust principles to service-to-service authentication and authorisation.
Support the development of secure microservices architecture standards and security design patterns.
Conduct threat modelling and security architecture reviews for cloud-native applications.
Collaborate with software architects and development teams to implement security-by-design principles.
Ensure microservices security controls align with organisational security policies and recognised industry standards.
API Security and Service-to-Service Protection
Implement and maintain security controls for RESTful APIs, GraphQL APIs and microservices endpoints.
Configure secure API authentication and authorisation mechanisms.
Implement OAuth 2.0, OpenID Connect, JSON Web Tokens (JWT) and mutual TLS (mTLS).
Secure API gateways and manage API access policies.
Identify and mitigate common API vulnerabilities, including those outlined in the OWASP API Security Top 10.
Implement API rate limiting, request validation and traffic protection mechanisms.
Secure service-to-service communications within distributed environments.
Monitor API security events and investigate suspicious access patterns.
Support API security testing and vulnerability remediation.
Container and Kubernetes Security
Implement security controls across Docker and Kubernetes environments.
Conduct container image vulnerability assessments and security configuration reviews.
Secure container registries, runtime environments and orchestration platforms.
Configure Kubernetes Role-Based Access Control (RBAC), network policies and workload security controls.
Implement secure secrets management and container authentication mechanisms.
Monitor container and Kubernetes security events.
Identify and remediate misconfigurations within containerised environments.
Apply security hardening standards to Kubernetes clusters and workloads.
Support container runtime protection and cloud-native threat detection.
Collaborate with infrastructure and DevOps teams to maintain secure container platforms.
DevSecOps and Secure Software Development
Integrate security controls into software development and CI/CD pipelines.
Implement automated application security testing within development workflows.
Support Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA).
Identify vulnerabilities in application code, third-party dependencies and container images.
Implement secure coding standards and software supply chain security controls.
Support Infrastructure as Code (IaC) security scanning and configuration validation.
Collaborate with development teams to remediate security findings.
Promote secure software development lifecycle (SSDLC) practices.
Support continuous security monitoring and automated compliance checks.
Cloud-Native Security and Infrastructure Protection
Implement security controls for microservices deployed across Microsoft Azure, AWS or Google Cloud environments.
Secure cloud-native application platforms and managed Kubernetes services.
Configure network segmentation and secure connectivity between microservices.
Implement cloud identity and access management controls.
Secure application secrets, cryptographic keys and sensitive configuration information.
Support service mesh security implementations.
Implement workload identity and secure service authentication.
Assess cloud-native infrastructure for vulnerabilities and security misconfigurations.
Support security monitoring, logging and incident response within distributed application environments.
Security Monitoring, Risk Management and Compliance
Monitor microservices and API security events using relevant security monitoring tools.
Investigate application security incidents and coordinate remediation activities.
Conduct vulnerability assessments and security risk reviews.
Maintain security documentation, assessment reports and remediation records.
Support security audits and compliance assessments involving cloud-native applications.
Implement security controls aligned with ISO 27001, NIST and OWASP guidance.
Monitor emerging microservices, container and API security threats.
Recommend improvements to application security architecture and operational processes.
Provide technical guidance to development, DevOps and infrastructure teams.
Minimum Requirements
Relevant diploma or degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Information Security or a related discipline.
Typically 3–5 years of relevant experience in application security, DevSecOps, cloud-native security or microservices security.
Proven hands-on experience implementing security controls within microservices or distributed application environments.
Strong understanding of microservices architecture and secure application design principles.
Practical experience securing REST APIs and service-to-service communications.
Strong knowledge of OAuth 2.0, OpenID Connect, JWT and TLS/mTLS.
Experience implementing or assessing security controls within Docker and Kubernetes environments.
Understanding of Kubernetes RBAC, network policies, secrets management and container security.
Experience with application security testing tools and methodologies.
Knowledge of OWASP Top 10 and OWASP API Security Top 10.
Experience integrating security controls into CI/CD pipelines.
Familiarity with cloud-native platforms such as Microsoft Azure, AWS or Google Cloud.
Understanding of secure software development lifecycle and DevSecOps principles.
Experience conducting vulnerability assessments and coordinating security remediation.
Strong technical troubleshooting, analytical and documentation skills.
Technical Skills and Competencies
Microservices and Application Security
Microservices architecture and distributed systems
Secure application architecture
Microservices threat modelling
Service-to-service authentication and authorisation
Zero Trust application security
Secure software development lifecycle
Application vulnerability assessments
Secure coding principles
OWASP Top 10
OWASP API Security Top 10
API Security Technologies
RESTful API security
GraphQL API security
OAuth 2.0
OpenID Connect (OIDC)
JSON Web Tokens (JWT)
Mutual TLS (mTLS)
API authentication and authorisation
API gateways
API rate limiting and request validation
API vulnerability testing
Experience with platforms such as:
Azure API Management
AWS API Gateway
Kong Gateway
Apigee
NGINX
Other enterprise API management and security solutions
Container and Kubernetes Security
Docker
Kubernetes
Kubernetes RBAC
Kubernetes Network Policies
Container image scanning
Container runtime security
Kubernetes secrets management
Kubernetes security hardening
Admission controllers and policy enforcement
Container registry security
Experience with tools such as:
Trivy
Aqua Security
Prisma Cloud
Sysdig
Falco
Kubescape
Other container and Kubernetes security platforms
DevSecOps and Application Security Testing
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Software Composition Analysis (SCA)
Infrastructure as Code security scanning
CI/CD pipeline security
Software supply chain security
Dependency vulnerability management
Secrets scanning
Automated security testing
Security policy enforcement
Experience with tools such as:
SonarQube
Checkmarx
Fortify
Snyk
Veracode
OWASP ZAP
Burp Suite
GitHub Advanced Security
GitLab Security
Cloud-Native Security
Microsoft Azure
Amazon Web Services (AWS)
Google Cloud Platform (GCP)
Azure Kubernetes Service (AKS)
Amazon Elastic Kubernetes Service (EKS)
Google Kubernetes Engine (GKE)
Cloud IAM and workload identity
Cloud-native network security
Secrets and key management
Cloud workload protection
Service Mesh and Secure Communications
Istio
Linkerd
Envoy
Service mesh security
Mutual TLS
Service identity
Traffic encryption
Service-to-service authorisation
Secure ingress and egress controls
Network segmentation
Automation and Infrastructure as Code
Terraform
Kubernetes YAML
Helm
Dockerfiles
GitHub Actions
GitLab CI/CD
Jenkins
Azure DevOps
Python
Bash
PowerShell
Security automation and configuration validation
Security Monitoring and Incident Response
Application security logging
Kubernetes audit logging
Cloud-native threat detection
SIEM integration
Container runtime monitoring
API security monitoring
Vulnerability management
Security incident investigation
Threat detection and remediation
Security Frameworks and Standards
OWASP Top 10
OWASP API Security Top 10
OWASP Application Security Verification Standard (ASVS)
NIST Secure Software Development Framework (SSDF)
NIST Cybersecurity Framework
ISO/IEC 27001
CIS Kubernetes Benchmark
Zero Trust security architecture
Cloud-native security best practices
Relevant Certifications (Advantageous)
One or more of the following certifications would be beneficial:
Certified Kubernetes Security Specialist (CKS)
Certified Kubernetes Administrator (CKA)
Certified Kubernetes Application Developer (CKAD)
Certified Cloud Security Professional (CCSP)
Certified Information Systems Security Professional (CISSP)
Certified Ethical Hacker (CEH)
CompTIA Security+
Microsoft Certified: Azure Security Engineer Associate
AWS Certified Security – Specialty
Google Cloud Professional Cloud Security Engineer
Relevant DevSecOps, application security or cloud-native security certifications
Key Personal Attributes
Strong analytical and technical problem-solving abilities.
Excellent understanding of modern application security threats.
Strong attention to detail and security awareness.
Ability to identify and remediate complex microservices security vulnerabilities.
Proactive approach to secure application development and infrastructure protection.
Excellent communication and stakeholder engagement skills.
Ability to collaborate effectively with development, DevOps, cloud and cybersecurity teams.
Strong organisational and technical documentation skills.
Ability to manage multiple security priorities and technical projects.
High levels of confidentiality, accountability and professional integrity.
Application Requirements
Interested candidates should submit an updated CV clearly detailing their practical microservices security, API security, container security and DevSecOps experience, together with copies of relevant academic qualifications and professional certifications.
Candidates should specifically highlight:
Microservices architectures and distributed application environments they have secured.
Experience implementing API authentication, authorisation and security controls.
Practical experience with Docker, Kubernetes and container security.
OAuth 2.0, OpenID Connect, JWT and mutual TLS implementation experience.
API gateway security and service-to-service communication protection.
Application security testing and vulnerability remediation experience.
DevSecOps, CI/CD security and automated security testing experience.
Cloud-native security implementations across Azure, AWS or GCP.
Service mesh security, workload identity and secrets management experience.
Security tools, platforms and technologies they have implemented or administered.
Relevant microservices security, application security and cloud-native security projects.
Professional certifications and specialised technical training.
Important: This is a specialist Microservices Security opportunity requiring demonstrable hands-on experience securing microservices architectures, APIs and cloud-native applications. General software development, infrastructure administration or cybersecurity experience without substantial microservices security expertise will not be sufficient.
Please note: Specific project requirements, remuneration, employment arrangements and working conditions will be confirmed during the recruitment process.
