DevOps / Cloud / Security Engineer

Description:

DevOps / Cloud / Security Engineer

Summary about the Role

We are looking for a hands-on DevOps / Cloud / Security Engineer to own our CI/CD pipelines, deployment/release processes, and security tooling on our Azure AKS platform. Platform and cluster maintenance are owned by a separate team;  this role is not responsible for platform setup or ongoing cluster administration.

This role sits at the intersection of DevOps, DevSecOps, and release engineering , you'll design and maintain the CI/CD pipelines our engineering teams ship through, execute and support deployments end-to-end, and own the security scanning, vulnerability management, and secrets management processes that keep our systems safe.

What You'll Do

CI/CD & Deployment

•    Design, build, and maintain CI/CD pipelines, primarily in GitHub Actions (reusable workflows, matrix builds, self-hosted runner management, OIDC-based authentication).

•    Maintain and gradually migrate legacy Jenkins pipelines strong Jenkins knowledge is required

•    Support release and deployment processes, including rollout strategies and rollback procedures.

•    Own GitOps workflows with ArgoCD: Application CRDs, sync policies, health checks, automated rollback.

Deployment & Troubleshooting (Azure AKS)

•    Execute and support application deployments to Azure AKS; this role owns the deployment/release execution, not platform or cluster maintenance (that sits with a separate platform team).

•    Be the first line of troubleshooting for deployment and post-deployment issues: failed rollouts, pods not starting, misconfigured services, or a URL/endpoint becoming inaccessible after a release diagnosing root cause (application, ingress, DNS, certificates, config, secrets) and either resolving it or escalating to the right owner.

•    Author and maintain Helm charts as our primary IaC tool for deployments (chart authoring, templating, upgrade strategies, helm test, dependency management).

•    Use Terraform for Azure infrastructure provisioning tasks tied to deployments, beyond Helm/AKS (secondary tool in the current stack, but required knowledge).

•    Work within existing Kubernetes NetworkPolicies and RBAC configurations to deploy and debug applications safely.

•    Support autoscaling behavior (KEDA / HPA) for deployed workloads, including scaling based on Kafka lag or custom metrics.

Monitoring & Observability

•    Own our Datadog implementation: Agent configuration (including socket mode), reading APM traces, Java library injection, building dashboards and monitors, log pipelines, maintaining the Service Catalog, and configuring Watchdog alerts.

•    Understand and be able to articulate why Prometheus endpoints were disabled in favor of Datadog, including the trade-offs of that decision.

•    Support the strategic move toward OpenTelemetry (OTEL) as a vendor-agnostic observability standard.

Security & Compliance

•    Own the security toolchain and remediation process end-to-end: SonarQube Snyk Lacework Datadog ASM, including managing findings against defined SLAs (Critical: 24h / High: 1 week).

•    Administer SonarQube: quality gates, fail-the-build policies, project setup, branch analysis, reporting.

•    Run Snyk for container, IaC (Helm/YAML), and dependency scanning in CI/CD; prioritize findings and leverage the Snyk bot for automated fix PRs.

•    Use Lacework for CSPM, runtime anomaly detection, and CIS Benchmark compliance reporting, translating findings into actionable Jira tickets.

•    Perform threat modeling and manage vulnerability management processes across the stack.

•    Integrate OWASP Dependency Check and OWASP ZAP (DAST) as GitHub Actions in CI/CD.

•    Implement runtime security with Falco as a complement to Lacework.

•    Generate and manage SBOMs (Syft / CycloneDX) and contribute to SLSA supply chain security practices.

Secrets Management

•    Manage secrets using Sealed Secrets / kubeseal and External Secrets (rotation, namespace scoping, recovery strategy).

•    Manage CI/CD pipeline secrets effectively including lifecycle handling. Should be knowledgeable on CI/CD secrets management from cloud providers

FinOps

•    Monitor and optimize AKS cost: right-sizing, resource quotas, spot-node strategy.

AI Experience

•    Explore AI-assisted operations tooling (e.g., GitHub Copilot for IaC, Datadog AI Insights / anomaly detection).

What You Bring

•    Solid production experience deploying to and operating within Kubernetes / AKS (Azure) ; comfortable diagnosing and resolving deployment and post-deployment issues. (Cluster/platform setup and maintenance are owned by a separate team and are not part of this role.)

•    Strong troubleshooting instincts: able to trace a "service/URL not accessible" issue through the stack ingress, DNS, certificates, service/pod health, config, and secrets  and resolve or escalate appropriately.

•    Strong hands-on skills with Docker and JFrog Artifactory.

•    Proven experience building and maintaining CI/CD pipelines in GitHub Actions; solid working knowledge of Jenkins (our current legacy platform, being phased out).

•    Strong hands-on experience with Helm as a primary IaC tool; working knowledge of Terraform.

•    Strong hands-on experience with ArgoCD and GitOps workflows.

•    Experience with Datadog (or comparable APM/monitoring platforms) for monitoring, alerting, and log management.

•    Familiarity with Azure DevOps is a plus, though it is not the primary tooling in our current production stack.

•    Strong security background: pipeline security scanning, vulnerability management, threat modeling, and remediation processes.

•    Experience with SonarQube, Snyk (or similar SCA/container/IaC scanning tools), and cloud security posture management tools (e.g., Lacework).

•    Experience with Kubernetes secrets management (Sealed Secrets, External Secrets, Azure Key Vault integration).

•    Solid scripting skills (e.g., Bash, Python, or similar).

•    Understanding of Kubernetes NetworkPolicies and RBAC.

•    Ability to work independently in a fast-moving environment, balancing operational stability with ongoing modernization efforts.

Nice to Have

•    Experience with OpenTelemetry (OTEL) migrations.

•    Exposure to DAST tooling (e.g., OWASP ZAP) integrated into CI/CD.

•    Experience with SBOM generation (Syft/CycloneDX) and SLSA supply chain security frameworks.

•    Experience with Backstage.io or other internal developer portal platforms.

•    FinOps experience, particularly around Kubernetes/AKS cost optimization.

•    Experience with KEDA/HPA autoscaling based on custom or event-driven metrics.

•    Experience with Falco or other Kubernetes runtime security tools.

•    Interest or experience in applying AI-assisted tooling to DevOps/IaC workflows.