{"id":2500299,"url":"https://alion.io/job/rosterfy-senior-platform-engineer-devsecops-3","title":"Senior Platform Engineer - DevSecOps","company":{"id":394,"name":"Rosterfy","domain":"rosterfy.com","url":"https://alion.io/company/rosterfy","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"HiBob","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Melbourne, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":84000,"max_usd":198000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":1891},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon CloudWatch","optional":false},{"name":"Amazon EC2","optional":false},{"name":"Amazon EKS","optional":false},{"name":"Amazon S3","optional":false},{"name":"AWS","optional":false},{"name":"AWS CDK","optional":false},{"name":"BigQuery","optional":false},{"name":"Buildkite","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"GitHub","optional":false},{"name":"Google BigQuery","optional":false},{"name":"IAM","optional":false},{"name":"Incident Management","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Looker","optional":false},{"name":"OpenAI","optional":false},{"name":"OpenTelemetry","optional":false},{"name":"OWASP","optional":false},{"name":"Pinecone","optional":false},{"name":"RAG","optional":false},{"name":"Shift-Left","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"Vertex AI","optional":false},{"name":"Evidently AI","optional":true},{"name":"Google GKE","optional":true},{"name":"Lacework","optional":true},{"name":"Laravel","optional":true},{"name":"PHP","optional":true},{"name":"SBOM","optional":true},{"name":"SLSA","optional":true},{"name":"Wiz","optional":true}],"status":"live","first_seen_at":"2026-06-25T05:45:14Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-14T17:46:22Z","board_verified":true,"closed_at":null,"days_open":111,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":111},"description":"As a Senior Platform Engineer - DevSecOps at Rosterfy, you will be the hands-on security engineering owner for the cloud infrastructure that powers Rosterfy across AWS (our primary platform, running the main app and web app) and GCP (our data layer). You will take ownership of the platform security working with the broader engineering team to embed continuous, shift-left security as a paved road for every squad rather than a gate that slows them down.You will be central to how we scale Rosterfy (event-driven architecture and domain-driven design), working across Kubernetes (EKS), CI/CD pipelines (BuildKite and GitHub), observability tooling, and infrastructure as code. Security is built into all of it: you will own secret management, identity and access, policy-as-code guardrails, vulnerability management, and the technical evidence behind our SOC 2, ISO 27001, & GDPR obligations, working alongside Engineering.\nYou will improve developer experience through better local workflows, automation, and consistent environments, and you will help us safely enable AI at scale: not just standing up LLM, RAG, and vector workloads, but securing them against prompt injection, data leakage, and supply-chain risk, and governing how AI coding assistants are used across the team. You will play a key role down the line as to how we evolve the platform to support our data and ML ambitions across BigQuery, Vertex AI, and real-time event processing.\nIn your first 90 days you will document our security architecture and key operational runbooks, ensuring this critical knowledge is captured and resilient as the team grows.\nResponsibilities\nMaintain and evolve our cloud infrastructure and container platform (currently AWS EKS, managed as Click Ops which needs to be converted to IAAC infrastructure-as-code such as Terraform). Equivalent experience on comparable platforms is welcome: strong IaC and container fundamentals matter more to us than exact tool parity\nTriage & Resolve failing tests, security alerts from Vanta, working with the engineering team, delegate where needed. \nPlay a key role in maintaining our existing SOC 2 and ISO 27001 posture, Automate control enforcement and evidence collection in Vanta, remediate gaps before they become audit findings, and own the technical evidence during surveillance/recertification audits.\nMake key recommendations, experiment and implement new tooling in conjunction with the Head of Engineering. \nOwn platform security as a first-class outcome: secure-by-default infrastructure, least-privilege access, and security guardrails encoded as policy-as-code so squads inherit safe defaults\nKeep systems observable, cost-optimised, and scalable, treating security signals (configuration drift, misconfiguration, anomalous access) as first-order telemetry alongside performance\nAutomate build, deployment, and release workflows in our CI/CD (currently BuildKite and GitHub, or comparable pipelines), with security embedded in the pipeline: dependency, secret, container, and IaC scanning, plus signed and traceable builds.\nCollaborate with squads to improve developer productivity and environment consistency\nImplement monitoring, alerting, and logging solutions (e.g., OpenTelemetry, CloudWatch or similar)\nOwn the technical side of secrets management, identity and access (RBAC/IAM), audit logging, & automate the control enforcement & evidence (Vanta) behind our compliance programs (SOC 2, ISO 27001), partnering with Engineering proactively.\nEvaluate infrastructure readiness for data workloads (Vertex AI, BigQuery, Looker)\nParticipate in incident response & on-call for both reliability and security incidents: detection, triage, containment, root-cause analysis, & post-incident review that feeds back into our controls and compliance evidence.\nConduct experiments that have been signed off by the Head of Engineering & CTO and advise on AI tooling to help with automation and infrastructure health as we grow and scale. \nEnsure infrastructure readiness for AI/ML workloads including BigQuery, Vertex AI, vector DBs (e.g., Pinecone), and GenAI pipelines\nPlay a key role in Engineering Discovery ensuring the appropriate observability, logging, monitoring and support attributes are in place to productionise features.\n Building for AI CapabilityBuild security into our AI platform from the start: LLM security controls (e.g. OWASP LLM Top 10), prompt-injection and data-leakage protection, tenant isolation and PII handling for RAG and vector stores, and access control on model endpoints\nMaintain visibility and provenance over AI components\n Deploy embedding/vector DBs, RAG pipelines\nWork with ML & GenAI models via Vertex AI, OpenAI, Claude, etc.\nRequirements\n Technical - Essential7+ years in DevOps, platform, or SRE roles supporting production SaaS, with security a recurring theme in your work (not necessarily a security job title).\nProficient with AWS (e.g. EKS, EC2, RDS, S3), infrastructure-as-code (e.g. AWS CDK), and CI/CD systems. Equivalent cloud experience transfers.\nStrong Docker, Linux, and container orchestration fundamentals.\nHands-on with cloud identity, access, and secrets/key management (e.g. AWS IAM, KMS, Secrets Manager).\nExperience embedding security into CI/CD pipelines: dependency, secret, container, and IaC scanning, with least-privilege by default. The practice matters more than the specific tools.\nFamiliarity with observability and incident management, including participating in incident response and on-call for both reliability and security events.\nExperience supporting developer tooling and internal platform services.\nStrongly Desirable\nExperience operating in a compliance environment (SOC 2, ISO 27001, Essential Eight, or GDPR) and producing audit evidence.\nHands-on with Vanta (or comparable GRC/compliance automation), including resolving failing controls and producing audit evidence for an already-certified SOC 2 / ISO 27001 environment.\nComfortable working within our PHP/Laravel application codebase to remediate application-level security findings (dependency vulnerabilities, input handling, headers, encryption), not just infrastructure.\nExposure to cloud security tooling such as CNAPP/CSPM (e.g. Lacework, Wiz, Prisma); concepts transfer across products.\nFamiliarity with threat modelling and secure SDLC practices.\nAwareness of software supply-chain security (SBOM, artifact signing, SLSA).\nGCP infrastructure (e.g. GKE, IAM) and cost optimisation.\n\n BonusAI/LLM security awareness (e.g. OWASP LLM Top 10, securing RAG and model endpoints).\nA security certification such as AWS Security Specialty or CKS.\nData/ML platform exposure: BigQuery, Vertex AI, vector databases, and GenAI prompt-execution endpoints (OpenAI / Vertex AI Generative AI APIs).\nIntegrating observability for model performance, latency, and data drift (e.g. OpenTelemetry, Vertex AI Model Monitoring, WhyLabs, Evidently AI).\nCharacter & MindsetResilient and adaptable - You embrace change and help others navigate ambiguity with calm and confidence.\nProactive problem solver - You identify issues early, take ownership, and push solutions forward without waiting to be asked.\nClear communicator - You articulate ideas clearly, write well, and listen with intent. You create shared understanding.\nProduct-minded - You’re curious about customer needs, ask “why?”, and advocate for solutions that deliver real value.\nLeads through influence - You raise the bar by mentoring others, setting standards, and sharing knowledge - not by authority.\nDocumentation-first thinker - You value written clarity, and help your team by documenting decisions, code, and processes.\nBenefits\nCompetitive salary offering \nPaid time off to participate in volunteering activities\nReferral bonuses and recognition programs\nWhy you want to work with us\nRapid Growth: Rosterfy is a rapidly expanding company, doubling in size every year. Backed by top investors, Rosterfy is on a rocket ship trajectory, set for incredible growth and success.\nGlobal Impact: We are reshaping volunteering globally and have an ambitious goal to redefine what it means to be a volunteer. Work with us, and be certain that you will make an impact.\nWell-liked: with 4.5 stars on Capterra, 4.4 stars on G2, and winners of various awards, we are well liked by clients and recognised for our exceptional service and innovative solutions.\nAwesome clients: We've been the volunteer management platform for 7 consecutive Super Bowls, Lifeline, & Oxfam amongst many other happy clients across 26 countries.\nCompetitive salary: We offer a competitive salary commensurate with experience and qualifications, along with comprehensive benefits.\nCheck out our Employee Value Proposition slide deck here!","description_format":"text","description_chars":8737,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Australia","iso":"AU","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["DevSecOps","Event Management","Nonprofits & Foundations"],"lifecycle":[{"event":"open","at":"2026-10-14T05:41:43Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.271,"p_room":0.28,"age_days":111,"expected_fill_days":31,"reasons":["conf:0","win:tail","crowd:"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/rosterfy-senior-platform-engineer-devsecops-3","json_url":"https://alion.io/job/rosterfy-senior-platform-engineer-devsecops-3.json","meta":{"generated_at":"2026-10-14T19:23:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25495,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":394},"rest":"https://alion.io/mcp/rest/get_company?id=394"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Frosterfy-senior-platform-engineer-devsecops-3"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Frosterfy-senior-platform-engineer-devsecops-3"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Frosterfy-senior-platform-engineer-devsecops-3"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/rosterfy-senior-platform-engineer-devsecops-3\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Frosterfy-senior-platform-engineer-devsecops-3"}]}