DevSecOps Engineer | Remote from Pakistan | PKR Tax-free Salary

About the Company:

A technology and digital solutions company that helps businesses move complex digital initiatives forward through expertise in Artificial Intelligence (AI), cloud technologies, software delivery, and technical talent.

Role Overview - DevSecOps Engineer

Job Overview: You will work at an early-stage healthtech SaaS startup in KSA. You own the GCP infrastructure and the security of the platform. How a change gets to production, how a clinic is provisioned with its data segregated from day one, who can touch what, and how we know. You are the first platform hire and the first security hire, so the conventions everyone inherits are yours.

Must Have:

• You have carried production for a multi-tenant B2B SaaS with paying customers

• You have designed and enforced least-privilege access for a real engineering team.

• An identity provider, role design, and the removal of access from people who had it.

• Deep GCP — Cloud Run, Cloud SQL, VPC, IAM, Secret Manager, workload identity

• Terraform in production, including codifying an existing estate.

• Extensive experience operating on GITLAB.

• CI/CD you built and made the only path, including runner and secrets hardening.

• PostgreSQL operations — pooling, replicas, failover, a restore you ran.

• You write code — enough Python or C# to open the merge request yourself.

• Ability to work in cross-functional teams.

• High proficiency in English communication.

Responsibilities and ownership:

• The path to production: The pipeline is the only way anything reaches a client: merge request, review, green tests, staged rollout, rollback that has been used. Migrations managed across environments. Hardened runners. Delivery that does not depend on who is awake.

• Identity & access: One identity provider across GitLab, GCP, production data, and internal tools. Role-based access designed around what each engineer does, reviewed on a schedule, time-boxed elevation for the exception. Joining and leaving are checklists that run in under an hour.

• Secrets, keys & devices: Secret Manager, masked CI variables, workload identity instead of long-lived keys, rotation with an owner. A minimum standard for the personal machines the team works from, and a way to verify it. Secrets never live on a laptop.

• Tenant operations: Onboarding a client is a pipeline which includes provisioning, configuration, seeding, and a segregation model for deployment, data, and audit that is built in rather than bolted on.

• Infrastructure as code: Terraform across the whole estate; environments that can be destroyed and recreated. Private data tier, controlled egress, edge protection, organisation policy that makes the safe thing the default.

• Audit & detection: Who touched which system and who opened which patient record — tamper-evident, queryable, written to a sink you do not control. Alerts on what should never happen.

• Observability & on-call: Tracing across .NET and Python so a booking is followable end to end. SLOs per clinical journey, alerts that page on a broken journey, a blameless incident process with post-mortems people read.

• PostgreSQL & real-time: Pooling that survives Cloud Run scale-out, replicas, failover, restore drills actually run. WebSocket sessions that last a whole appointment, kept alive across scaling.

Good to have:

• Healthcare or other regulated SaaS.

• Understanding and experience of HIPAA, NPHIES, PDPL, and ISO 27001.

• Kafka or Pub/Sub — we move to an event bus after the current direct-HTTP phase.

Experience: 5+ years
Location: Remote

About HR Ways: HR Ways is an award-winning Technical Recruitment Firm helping software houses and IT Product companies internationally and locally to find IT Talent. HR Ways is engaged by 300+ Employers worldwide, ranging from the world's biggest SaaS Companies to the most competitive Startups. We have entities in Dubai, Canada, the US, the UK, Pakistan, India, Saudi Arabia, Portugal, Brazil, and other parts of the world. Join our WhatsApp Channel at https://whatsapp.com/channel/0029VamSiLr5fM5fMtAdCS2M to stay updated, or visit to learn more.