Lead DevSecOps Engineer

The Lead DevSecOps Engineer is responsible for driving the integration of security principles into the development and operations processes. This role will champion a security-first culture, design and implement robust security controls, and automate security testing and compliance measures. By collaborating closely with development, operations, and security teams, the Lead DevSecOps Engineer will ensure confidentiality, integrity, and availability of our systems and applications.

Responsibilities:

• Secure CI/CD Pipeline Management (Azure DevOps): Design, implement, manage, and optimise secure CI/CD pipelines and related processes within Azure DevOps.
• Infrastructure as Code (IaC) with Security: Implement, maintain, and secure infrastructure using Terraform within Azure DevOps pipelines, incorporating security best practices.
• Automated Security Testing and Vulnerability Management: Integrate security scanning tools (SAST, DAST, SCA) and implement automated vulnerability management processes.
• Security Collaboration and Requirements: Collaborate with security teams to define security requirements and implement security controls across the SDLC.
• Secrets Management and Security Monitoring: Implement and manage secrets management solutions (e. g., Azure Key Vault) and security monitoring/logging.
• Security Assessments and Hardening: Conduct regular security assessments, penetration testing, and infrastructure hardening to minimise attack surface.
• Container Security (Docker/Kubernetes): Implement and manage container security scanning and vulnerability management for Docker and Kubernetes environments.
• Network Security within IaC: Implement and manage network security controls within the infrastructure-as-code.
• Policy as Code (OPA) Implementation: Implement and manage Policy as Code (OPA) for enforcing security and compliance policies.
• DevSecOps Mentorship and Training: Coach and guide engineering teams on secure coding practices and DevSecOps principles.
• GitOps and Kubernetes Deployment Management: Design and manage GitOps workflows using tools such as FluxCD, Helm, and Kustomize to enable declarative, version-controlled Kubernetes deployments and configuration management.
• Cross-Functional Collaboration: Work closely with development, operations, and security teams to ensure seamless integration of security.
• DevSecOps Ownership and Advocacy: Drive DevSecOps adoption and ownership across the business, working closely with key stakeholders.
• Continuous Improvement and Best Practices: Stay up-to-date with the latest DevSecOps trends and best practices, driving continuous improvement within the organisation.

Requirements:

• Extensive DevSecOps Experience: 5+ years of practical experience in DevOps/DevSecOps roles, demonstrating a deep understanding of principles and implementation.
• Cloud and IaC Expertise: Strong expertise in a major cloud platform (especially Azure) and Infrastructure as Code (IaC) using Terraform.
• CI/CD and Security Integration: Proven ability to design, implement, and secure CI/CD pipelines, integrating security scanning and vulnerability management tools.
• Containerisation and Orchestration: Solid understanding and hands-on experience with containerisation technologies (Docker, Kubernetes) and container security.
• Communication and Collaboration: Excellent communication, collaboration, and mentoring skills, with the ability to work effectively across teams and influence technical direction.
• Experience in deploying PaaS solutions, API's, and Infrastructure as Code (Terraform) to Azure.
• Automation for build and release management - automate and streamline operations and processes.
• Release Management utilising Azure DevOps/VSTS mandatory.
• Excellent Scripting Skills (PowerShell, Shell and Python).
• GitOps Tooling: Hands-on experience with GitOps practices and tooling, including FluxCD, Helm, and Kustomize, for managing Kubernetes workloads and application deployments.