Manager - Engineering DevSecOps

The candidate will have responsibilities across the following functions:

Team Leadership and People Management:

• Build the Team: Own hiring for the DevSecOps team end-to-end — define roles and levelling, run a high-signal interview loop, and close senior candidates in a competitive market.
• Develop Engineers: Run regular 1:1s, set clear expectations and growth plans, and actively develop engineers toward Senior and Staff scope. Create and defend time for learning and deep work.
• Performance Management: Give direct, timely feedback. Run fair and well-evidenced performance cycles, recognise strong contributions, and address underperformance early and constructively.
• Team Health: Own on-call sustainability, workload balance, and retention. Build a psychologically safe environment where engineers surface risk and bad news early.

Delivery and Execution:

• Roadmap Ownership: Own the DevSecOps team roadmap. Translate security strategy and engineering priorities into a sequenced, resourced plan with clear owners and dates.
• Predictable Delivery: Run planning, prioritisation, and execution rituals. Deliver committed work predictably and communicate slippage early with options, not surprises.
• Prioritisation and Tradeoffs: Arbitrate between security remediation, platform investment, compliance obligations, and support requests — and make the reasoning behind those calls visible.
• Dependency Management: Identify and unblock cross-team dependencies with Cloud Security, Product Security, SRE, and application teams before they become delivery risk.
• Metrics and Reporting: Define and report the team's operating metrics — vulnerability SLA adherence, mean time to detect and remediate, pipeline security coverage, control-automation progress — to engineering leadership.

Security Program Ownership:

• Platform Security Posture: Be accountable for the security posture of cloud infrastructure (AWS/Azure), Kubernetes and container platforms, and CI/CD toolchains.
• Shift-Left Program: Own the program that embeds automated security testing, static and dynamic analysis, IaC scanning, and dependency scanning into the development lifecycle, with adoption and signal quality as explicit goals.
• Vulnerability Management: Own the vulnerability lifecycle for the team's scope — intake, risk-based prioritisation, SLA definition and enforcement, remediation tracking, and exception governance.
• Compliance and Audit Readiness: Partner with GRC and Cloud Security to ensure infrastructure and deployments meet SOC 2, ISO 27001, PCI-DSS, and GDPR/CCPA obligations. Drive automated, continuously evidenced controls over manual evidence collection.
• Standards and Governance: Work with Cloud Security and Product Security to define security standards, policies, and frameworks — then own their rollout and adoption within your scope.

Operational Excellence and Incident Response

• Security Incident Management: Own the team's security incident response readiness. Act as incident commander or escalation point for infrastructure and pipeline security events.
• Post-Incident Rigour: Ensure every significant incident produces a blameless post-mortem with tracked systemic remediation — not just a closed ticket.
• Detection Coverage: Hold the team accountable for monitoring and alerting coverage, alert quality, and runbook completeness.
• Risk Escalation: Maintain a clear-eyed view of accepted risk in your scope and escalate it to leadership with context and recommended options.

Technical Judgment and Cross-Functional Partnership:

• Technical Depth: Review designs and architecture proposals, ask the right questions, and make or ratify consequential technical decisions — without becoming the bottleneck.
• Build vs Buy: Lead tooling evaluation and vendor decisions for security tooling, with cost, integration effort, and operational burden all accounted for.
• Stakeholder Management: Represent the team to engineering leadership, Security, GRC, and — where needed — enterprise customers and auditors.
• Security-First Culture: Partner with peer engineering managers to make secure practice the default across development teams through enablement, documentation, and shared goals rather than mandates.

Requirements:

• Bachelor's degree in computer science, Engineering, or a related technical field, or equivalent practical experience.
• 10+ years of experience in DevSecOps, Infrastructure Security, or Security Engineering roles.
• 3+ years directly managing engineers, including hiring, performance management, and career development.
• Prior experience as a senior individual contributor before moving into management.
• Strong working knowledge of cloud infrastructure (AWS, GCP, or Azure), container platforms (Docker, Kubernetes), and modern CI/CD toolchains such as Jenkins, Tekton, GitHub Actions, and ArgoCD — enough to lead technical discussions credibly.
• Solid understanding of secure infrastructure design, identity and access management, network security, and Infrastructure-as-Code practices.
• Demonstrated experience owning a security or infrastructure program with measurable outcomes — vulnerability SLAs, control automation, audit readiness, or incident-response maturity.
• Experience running incident response and blameless post-mortem practice for production systems.
• Excellent written and verbal communication; able to brief engineering leadership and translate technical risk into business terms.

Preferred:

• Experience managing a DevSecOps, Cloud Security Engineering, or Platform Security team specifically.
• Hands-on experience taking an organisation through SOC 2, ISO 27001, or PCI-DSS certification or audit.
• Experience in a multi-tenant SaaS environment handling regulated consumer or financial data.
• Familiarity with policy-as-code (OPA, Kyverno), secrets management (Vault, KMS), and software supply-chain security (SBOM, artefact signing).
• Experience building a team from a small base — defining process and operating cadence where little existed.
• Exposure to securing AI/ML workloads and agentic systems.
• Relevant certifications such as CISSP, CCSP, CKS, or AWS Certified Security - Speciality.