Senior DevSecOps Engineer

The candidate will have responsibilities across the following functions:

Architecture and Technical Strategy:

• Security Architecture: Define and evolve the DevSecOps reference architecture and secure-by-design standards adopted across engineering — covering cloud infrastructure, Kubernetes, containers, and CI/CD.
• Technical Roadmap: Own the multi-quarter DevSecOps roadmap. Make and defend build-vs-buy, tooling-consolidation, and platform-investment decisions with clear tradeoff analysis.
• Design Authority: Author and review design docs and RFCs for security-critical infrastructure. Serve as a decision-maker in architecture reviews where security posture is at stake.
• Ambiguity to Execution: Take loosely defined, multi-team security initiatives and decompose them into scoped, sequenced, executable roadmaps with clear ownership.

Platform and Pipeline Ownership:

• Secure Paved Road: Own the golden-path CI/CD pipeline — set gating policy, severity thresholds, break-the-build rules, and the developer-experience tradeoffs those choices imply.
• Shift-Left Automation: Drive SAST, DAST, SCA, IaC scanning, container image scanning, and secret detection into pipelines with low false-positive burden and actionable developer feedback.
• Infrastructure Hardening: Design and automate security controls across AWS/Azure/GCP resources, Kubernetes clusters, service meshes, and container runtimes — enforced as code, not documentation.
• Policy-as-Code: Establish and scale guardrails using OPA/Rego, Kyverno, admission controllers, and IaC policy enforcement so that insecure configuration cannot reach production.
• Supply-Chain Security: Own artefact provenance and integrity — SBOM generation, artefact signing and verification, dependency provenance, and build-system trust boundaries.
• Secrets and Identity: Architect secrets management and workload identity at scale — Vault/KMS, dynamic credentials, short-lived tokens, and least-privilege IAM across multi-account, multi-tenant environments.

Detection, Response and Governance:

• Threat Detection: Design monitoring, alerting, and detection-as-code for infrastructure and pipeline security signals; reduce mean time to detect through tuned, high-signal coverage.
• Incident Leadership: Lead security incident triage and response for infrastructure and pipeline events. Run blameless post-mortems and own systemic remediation, not just the immediate fix.
• Vulnerability Management: Own the end-to-end vulnerability lifecycle at platform scale — intake, risk-based prioritisation, SLA definition, automated remediation paths, and exception governance.
• Compliance Engineering: Translate SOC 2, ISO 27001, PCI-DSS, and GDPR/CCPA obligations into automated, continuously evidenced technical controls. Partner with GRC on audits and reduce manual evidence collection.
• Risk Arbitration: Frame security risk versus delivery velocity for engineering leadership, with clear options and recommendations rather than escalations.

Leadership and Influence:

• Cross-Org Leadership: Co-own security standards with Cloud Security and Product Security, and drive adoption across multiple engineering organisations through influence rather than authority.
• Mentorship: Mentor senior and mid-level DevOps engineers. Raise the technical bar through code review, design review, and deliberate knowledge transfer.
• Security-First Culture: Build and run the enablement layer — internal documentation, secure-by-default templates, training, and self-service tooling that makes the secure path the easy path.
• Continuous Improvement: Track emerging threats, vulnerabilities, and industry practices. Convert relevant developments into proposals with clear cost, impact, and rollout plans.

Requirements:

• Bachelor's degree in computer science, Engineering, or a related technical field, or equivalent practical experience.
• 8+ years of experience in DevOps and Security Engineering roles, including demonstrated experience operating at Staff-level scope leading security initiatives that span multiple teams or organisations.
• Deep hands-on expertise with cloud infrastructure (AWS, GCP, or Azure) at production scale, including multi-account and multi-tenant architectures.
• Expert-level understanding of secure infrastructure design, identity and access management, network security, and encryption in transit and at rest.
• Proven experience securing container platforms (Docker, Kubernetes) and modern CI/CD toolchains such as Jenkins, Tekton, GitHub Actions, and ArgoCD.
• Strong Infrastructure-as-Code background (Terraform, Helm) with IaC security tooling such as tfsec, Checkov, or Terrascan.
• Proficiency in at least one programming language (Python, Go, or similar) and the ability to build production-grade automation, not just scripts.
• Practical depth in vulnerability management, threat modelling, scanning, and remediation workflows at organisational scale.
• Track record of driving technical change across teams you do not own, with strong written communication, documentation, and stakeholder management skills.

Preferred:

• Experience with policy-as-code frameworks (OPA/Rego, Kyverno, Gatekeeper) deployed in production.
• Experience with software supply-chain security — SLSA, SBOM, Sigstore/Cosign, or in-toto.
• Experience implementing zero-trust and workload identity patterns (SPIFFE/SPIRE, IRSA, workload federation).
• Hands-on experience taking an organisation through SOC 2, ISO 27001, or PCI-DSS certification or audit.
• Experience securing multi-tenant SaaS platforms handling regulated consumer or financial data.
• Familiarity with securing AI/ML workloads, model-serving infrastructure, and agentic systems.
• Relevant certifications such as CKS, CISSP, OSCP, or AWS Certified Security - Speciality.