Microservices Security Specialist.

Microservices Security Specialist

Location: Centurion, Gauteng (provisional – to be confirmed) Positions Available: 5 Salary: Market-related Employment Type: To be confirmed

Job Overview

We are seeking experienced and technically proficient Microservices Security Specialists to design, implement, manage and continuously improve security controls across enterprise microservices architectures, containerised applications and cloud-native environments.

The successful candidates will be responsible for securing distributed applications, APIs, containers, Kubernetes environments and service-to-service communications against cybersecurity threats, vulnerabilities and unauthorised access.

This role requires strong hands-on expertise in microservices security, API protection, container security, DevSecOps, secure application architecture and cloud-native security technologies.

The ideal candidates will have proven experience implementing security controls within enterprise microservices environments, with a strong understanding of secure software development, application security testing, identity management and Zero Trust security principles.

Key Responsibilities

Microservices Security Architecture and Implementation

• Design, implement and maintain security controls across enterprise microservices architectures.

• Conduct security assessments of distributed applications and microservices environments.

• Identify and remediate security vulnerabilities within microservices, APIs and supporting infrastructure.

• Implement secure communication mechanisms between microservices and distributed applications.

• Apply Zero Trust principles to service-to-service authentication and authorisation.

• Support the development of secure microservices architecture standards and security design patterns.

• Conduct threat modelling and security architecture reviews for cloud-native applications.

• Collaborate with software architects and development teams to implement security-by-design principles.

• Ensure microservices security controls align with organisational security policies and recognised industry standards.

API Security and Service-to-Service Protection

• Implement and maintain security controls for RESTful APIs, GraphQL APIs and microservices endpoints.

• Configure secure API authentication and authorisation mechanisms.

• Implement OAuth 2.0, OpenID Connect, JSON Web Tokens (JWT) and mutual TLS (mTLS).

• Secure API gateways and manage API access policies.

• Identify and mitigate common API vulnerabilities, including those outlined in the OWASP API Security Top 10.

• Implement API rate limiting, request validation and traffic protection mechanisms.

• Secure service-to-service communications within distributed environments.

• Monitor API security events and investigate suspicious access patterns.

• Support API security testing and vulnerability remediation.

Container and Kubernetes Security

• Implement security controls across Docker and Kubernetes environments.

• Conduct container image vulnerability assessments and security configuration reviews.

• Secure container registries, runtime environments and orchestration platforms.

• Configure Kubernetes Role-Based Access Control (RBAC), network policies and workload security controls.

• Implement secure secrets management and container authentication mechanisms.

• Monitor container and Kubernetes security events.

• Identify and remediate misconfigurations within containerised environments.

• Apply security hardening standards to Kubernetes clusters and workloads.

• Support container runtime protection and cloud-native threat detection.

• Collaborate with infrastructure and DevOps teams to maintain secure container platforms.

DevSecOps and Secure Software Development

• Integrate security controls into software development and CI/CD pipelines.

• Implement automated application security testing within development workflows.

• Support Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA).

• Identify vulnerabilities in application code, third-party dependencies and container images.

• Implement secure coding standards and software supply chain security controls.

• Support Infrastructure as Code (IaC) security scanning and configuration validation.

• Collaborate with development teams to remediate security findings.

• Promote secure software development lifecycle (SSDLC) practices.

• Support continuous security monitoring and automated compliance checks.

Cloud-Native Security and Infrastructure Protection

• Implement security controls for microservices deployed across Microsoft Azure, AWS or Google Cloud environments.

• Secure cloud-native application platforms and managed Kubernetes services.

• Configure network segmentation and secure connectivity between microservices.

• Implement cloud identity and access management controls.

• Secure application secrets, cryptographic keys and sensitive configuration information.

• Support service mesh security implementations.

• Implement workload identity and secure service authentication.

• Assess cloud-native infrastructure for vulnerabilities and security misconfigurations.

• Support security monitoring, logging and incident response within distributed application environments.

Security Monitoring, Risk Management and Compliance

• Monitor microservices and API security events using relevant security monitoring tools.

• Investigate application security incidents and coordinate remediation activities.

• Conduct vulnerability assessments and security risk reviews.

• Maintain security documentation, assessment reports and remediation records.

• Support security audits and compliance assessments involving cloud-native applications.

• Implement security controls aligned with ISO 27001, NIST and OWASP guidance.

• Monitor emerging microservices, container and API security threats.

• Recommend improvements to application security architecture and operational processes.

• Provide technical guidance to development, DevOps and infrastructure teams.

Minimum Requirements

• Relevant diploma or degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Information Security or a related discipline.

• Typically 3–5 years of relevant experience in application security, DevSecOps, cloud-native security or microservices security.

• Proven hands-on experience implementing security controls within microservices or distributed application environments.

• Strong understanding of microservices architecture and secure application design principles.

• Practical experience securing REST APIs and service-to-service communications.

• Strong knowledge of OAuth 2.0, OpenID Connect, JWT and TLS/mTLS.

• Experience implementing or assessing security controls within Docker and Kubernetes environments.

• Understanding of Kubernetes RBAC, network policies, secrets management and container security.

• Experience with application security testing tools and methodologies.

• Knowledge of OWASP Top 10 and OWASP API Security Top 10.

• Experience integrating security controls into CI/CD pipelines.

• Familiarity with cloud-native platforms such as Microsoft Azure, AWS or Google Cloud.

• Understanding of secure software development lifecycle and DevSecOps principles.

• Experience conducting vulnerability assessments and coordinating security remediation.

• Strong technical troubleshooting, analytical and documentation skills.

Technical Skills and Competencies

Microservices and Application Security

• Microservices architecture and distributed systems

• Secure application architecture

• Microservices threat modelling

• Service-to-service authentication and authorisation

• Zero Trust application security

• Secure software development lifecycle

• Application vulnerability assessments

• Secure coding principles

• OWASP Top 10

• OWASP API