Senior DevSecOps Engineer – Cyber Security

About the role

We are looking for a senior security professional to lead the implementation and continuous improvement of DevSecOps practices across our software development lifecycle. You will embed security controls, automate assurance, and champion secure‑by‑design principles for cloud platforms, infrastructure, and CI/CD pipelines.

Key responsibilities

• Design, implement and operate CI/CD security controls such as SAST, DAST, SCA, secret detection, license compliance and artifact signing.
• Develop automation and pipeline integrations using Python, Bash or Go to enhance security tooling and runtime controls.
• Build and maintain secure platform guardrails, including hardened CI runners, least‑privilege service accounts and segregation of duties.
• Manage vulnerability management workflows: triage, risk‑based prioritisation, remediation SLAs and automated re‑testing.
• Establish secure configuration baselines for AWS, Azure, GCP, containers/Kubernetes and Infrastructure‑as‑Code (Terraform, CloudFormation, ARM).
• Own software supply‑chain security initiatives such as SBOM generation, dependency controls and artifact provenance.
• Implement secrets‑management practices with centralized vaulting, automated rotation and CI/CD secret hygiene.
• Define and track DevSecOps metrics/KPIs and lead security tool onboarding, evaluation and lifecycle management.
• Provide technical leadership, developer training, secure‑coding workshops and incident‑ready telemetry coordination with SOC/IR teams.

Required profile

• Senior‑level security professional with extensive experience in DevSecOps and secure software delivery.
• Proven ability to partner with engineering and operations teams to drive secure delivery and risk reduction.
• Strong understanding of cloud security, container orchestration and Infrastructure‑as‑Code security.

Required skills

• Python, Bash, Go
• SAST, DAST, SCA, secret detection, license compliance, artifact signing
• AWS, Azure, GCP
• Kubernetes, container image scanning, runtime policies, RBAC, network policies
• Terraform, CloudFormation, ARM templates
• SBOM generation, software supply‑chain security
• IAM least‑privilege design, logging/monitoring, key management
• CI/CD pipeline security, secure runner/agent hardening
• Secrets management platforms (e.g., Vault)