Staff DevSecOps Engineer

As a Staff DevOps Engineer on the DevSecOps team, you are the technical authority for how security is designed into Tekion's cloud-native platform. You will define the DevSecOps reference architecture that multiple engineering organisations build on, own the secure paved road from code commit to production, and set a multi-quarter technical roadmap for platform security. This is a high-leverage individual contributor role. Your output is measured less by the tickets you close and more by the security outcomes you enable across teams you do not manage through architecture, automation, standards, and influence.

The candidate will have responsibilities across the following functions:

Architecture and Technical Strategy:

• Security Architecture: Define and evolve the DevSecOps reference architecture and secure-by-design standards adopted across engineering, covering cloud infrastructure, Kubernetes, containers, and CI/CD.
• Technical Roadmap: Own the multi-quarter DevSecOps roadmap. Make and defend build-vs-buy, tooling-consolidation, and platform-investment decisions with clear tradeoff analysis.
• Design Authority: Author and review design docs and RFCs for security-critical infrastructure. Serve as a decision-maker in architecture reviews where security posture is at stake.
• Ambiguity to Execution: Take loosely defined, multi-team security initiatives and decompose them into scoped, sequenced, executable roadmaps with clear ownership.

Platform and Pipeline Ownership:

• Secure Paved Road: Own the golden-path CI/CD pipeline set gating policy, severity thresholds, break-the-build rules, and the developer-experience tradeoffs those choices imply.
• Shift-Left Automation: Drive SAST, DAST, SCA, IaC scanning, container image scanning, and secret detection into pipelines with low false-positive burden and actionable developer feedback.
• Infrastructure Hardening: Design and automate security controls across AWS/Azure/GCP resources, Kubernetes clusters, service meshes, and container runtimes enforced as code, not documentation.
• Policy-as-Code: Establish and scale guardrails using OPA/Rego, Kyverno, admission controllers, and IaC policy enforcement so that insecure configuration cannot reach production.
• Supply-Chain Security: Own artefact provenance and integrity, SBOM generation, artefact signing and verification, dependency provenance, and build-system trust boundaries.
• Secrets and Identity: Architect secrets management and workload identity at scale: Vault/KMS, dynamic credentials, short-lived tokens, and least-privilege IAM across multi-account, multi-tenant environments.

Detection, Response and Governance:

• Threat Detection: Design monitoring, alerting, and detection-as-code for infrastructure and pipeline security signals; reduce mean time to detect through tuned, high-signal coverage.
• Incident Leadership: Lead security incident triage and response for infrastructure and pipeline events. Run blameless post-mortems and own systemic remediation, not just the immediate fix.
• Vulnerability Management: Own the end-to-end vulnerability lifecycle at platform scale: intake, risk-based prioritisation, SLA definition, automated remediation paths, and exception governance.
• Compliance Engineering: Translate SOC 2, ISO 27001, PCI-DSS, and GDPR/CCPA obligations into automated, continuously evidenced technical controls. Partner with GRC on audits and reduce manual evidence collection.
• Risk Arbitration: Frame security risk versus delivery velocity for engineering leadership, with clear options and recommendations rather than escalations.

Leadership and Influence:

• Cross-Org Leadership: Co-own security standards with Cloud Security and Product Security, and drive adoption across multiple engineering organisations through influence rather than authority.
• Mentorship: Mentor senior and mid-level DevOps engineers. Raise the technical bar through code review, design review, and deliberate knowledge transfer.
• Security-First Culture: Build and run the enablement layer: internal documentation, secure-by-default templates, training, and self-service tooling that makes the secure path the easy path.
• Continuous Improvement: Track emerging threats, vulnerabilities, and industry practice. Convert relevant developments into proposals with clear cost, impact, and rollout plans.

Requirements:

• Bachelor's degree in computer science, Engineering, or a related technical field, or equivalent practical experience.
• 8+ years of experience in DevOps and Security Engineering roles, including demonstrated experience operating at Staff-level scope leading security initiatives that span multiple teams or organisations.
• Deep hands-on expertise with cloud infrastructure (AWS, GCP, or Azure) at production scale, including multi-account and multi-tenant architectures.
• Expert-level understanding of secure infrastructure design, identity and access management, network security, and encryption in transit and at rest.
• Proven experience securing container platforms (Docker, Kubernetes) and modern CI/CD toolchains such as Jenkins, Tekton, GitHub Actions, and ArgoCD.
• Strong Infrastructure-as-Code background (Terraform, Helm) with IaC security tooling such as tfsec, Checkov, or Terrascan.
• Proficiency in at least one programming language (Python, Go, or similar) and the ability to build production-grade automation, not just scripts.
• Practical depth in vulnerability management, threat modelling, scanning, and remediation workflows at organisational scale.
• Track record of driving technical change across teams you do not own, with strong written communication, documentation, and stakeholder management skills.

Preferred:

• Experience with policy-as-code frameworks (OPA/Rego, Kyverno, Gatekeeper) deployed in production.
• Experience with software supply-chain security SLSA, SBOM, Sigstore/Cosign, or in-toto.
• Experience implementing zero-trust and workload identity patterns (SPIFFE/SPIRE, IRSA, workload federation).
• Hands-on experience taking an organisation through SOC 2, ISO 27001, or PCI-DSS certification or audit.
• Experience securing multi-tenant SaaS platforms handling regulated consumer or financial data.
• Familiarity with securing AI/ML workloads, model-serving infrastructure, and agentic systems.
• Relevant certifications such as CKS, CISSP, OSCP, or AWS Certified Security - Speciality.

What Success Looks Like:

• First 90 days: You have mapped the current DevSecOps posture, identified the highest-risk gaps across the platform, and published a prioritised remediation and investment plan.
• Six months: The secure paved road is defined and adopted by priority teams; policy-as-code guardrails block the top misconfiguration classes before they reach production.
• Twelve months: Security controls are automated and continuously evidenced, audit preparation is substantially self-serve, and security review is a designed-in step rather than a release-time bottleneck.