DevSecOps Manager

We are looking for a DevSecOps Manager to lead the team responsible for securing Tekion's cloud infrastructure, container platforms, and CI/CD pipelines. You will manage a team of 5-8 DevSecOps engineers, own the team's roadmap and delivery commitments, and be accountable for the security posture of the infrastructure and deployment platforms. Tekion's engineering organization runs on.

This is a people and delivery leadership role. You will not be writing production code day to day, but you are expected to have the technical depth to review designs, challenge approaches, make informed tradeoffs, and earn the trust of a senior engineering team. Your success is measured by the quality, velocity, and growth of your team and by measurable improvement in security outcomes.

The core responsibilities for the job include the following:

Team Leadership and People Management:

• Build the Team: Own hiring for the DevSecOps team end to end, define roles and leveling, run a high-signal interview loop, and close senior candidates in a competitive market.
• Develop Engineers: Run regular 1:1s, set clear expectations and growth plans, and actively develop engineers toward senior and staff scope. Create and defend time for learning and deep work.
• Performance Management: Give direct, timely feedback. Run fair and well-evidenced performance cycles, recognize strong contribution, and address underperformance early and constructively.
• Team Health: Own on-call sustainability, workload balance, and retention. Build a psychologically safe environment where engineers surface risk and bad news early.

Delivery and Execution:

• Roadmap Ownership: Own the DevSecOps team roadmap. Translate security strategy and engineering priorities into a sequenced, resourced plan with clear owners and dates.
• Predictable Delivery: Run planning, prioritization, and execution rituals. Deliver committed work predictably and communicate slippage early with options, not surprises.
• Prioritization and Tradeoffs: Arbitrate between security remediation, platform investment, compliance obligations, and support requests and make the reasoning behind those calls visible.
• Dependency Management: Identify and unblock cross-team dependencies with cloud security, product security, SRE, and application teams before they become delivery risk.
• Metrics and Reporting: Define and report the team's operating metrics, vulnerability SLA adherence, mean time to detect and remediate, pipeline security coverage, and control-automation progress to engineering leadership.

Security Program Ownership:

• Platform Security Posture: Be accountable for the security posture of cloud infrastructure (AWS/Azure), Kubernetes and container platforms, and CI/CD toolchains.
• Shift-Left Program: Own the program that embeds automated security testing, static and dynamic analysis, IaC scanning, and dependency scanning into the development lifecycle, with adoption and signal quality as explicit goals.
• Vulnerability Management: Own the vulnerability lifecycle for the team's scope intake, risk-based prioritization, SLA definition and enforcement, remediation tracking, and exception governance.
• Compliance and Audit Readiness: Partner with GRC and Cloud Security to ensure infrastructure and deployments meet SOC 2, ISO 27001, PCI-DSS, and GDPR/CCPA obligations. Drive automated, continuously evidenced controls over manual evidence collection.
• Standards and Governance: Work with Cloud Security and Product Security to define security standards, policies, and frameworks, then own their rollout and adoption within your scope.

Operational Excellence and Incident Response:

• Security Incident Management: Own the team's security incident response readiness. Act as incident commander or escalation point for infrastructure and pipeline security events.
• Post-Incident Rigor: Ensure every significant incident produces a blameless post-mortem with tracked systemic remediation, not just a closed ticket.
• Detection Coverage: Hold the team accountable for monitoring and alerting coverage, alert quality, and runbook completeness.
• Risk Escalation: Maintain a clear-eyed view of accepted risk in your scope and escalate it to leadership with context and recommended options.

Technical Judgment and Cross-Functional Partnership:

• Technical Depth: Review designs and architecture proposals, ask the right questions, and make or ratify consequential technical decisions without becoming the bottleneck.
• Build vs Buy: Lead tooling evaluation and vendor decisions for security tooling, with cost, integration effort, and operational burden all accounted for.
• Stakeholder Management: Represent the team to engineering leadership, security, GRC, and, where needed, enterprise customers and auditors.
• Security-First Culture: Partner with peer engineering managers to make secure practice the default across development teams through enablement, documentation, and shared goals rather than mandates.

Requirements:

• Bachelor's degree in computer science, engineering, or a related technical field, or equivalent practical experience.
• 10+ years of experience in DevSecOps, Infrastructure Security, or Security Engineering roles.
• 3+ years directly managing engineers, including hiring, performance management, and career development. Prior experience as a senior individual contributor before moving into management.
• Strong working knowledge of cloud infrastructure (AWS, GCP, or Azure), container platforms (Docker, Kubernetes), and modern CI/CD toolchains such as Jenkins, Tekton, GitHub Actions, and ArgoCD enough to lead technical discussions credibly.
• Solid understanding of secure infrastructure design, identity and access management, network security, and infrastructure-as-code practices.
• Demonstrated experience owning a security or infrastructure program with measurable outcomes, vulnerability SLAs, control automation, audit readiness, or incident-response maturity.
• Experience running incident response and blameless post-mortem practice for production systems.
• Excellent written and verbal communication; able to brief engineering leadership and translate technical risk into business terms.

Preferred:

• Experience managing a DevSecOps, cloud security engineering, or platform security team specifically.
• Hands-on experience taking an organization through SOC 2, ISO 27001, or PCI-DSS certification or audit.
• Experience in a multi-tenant SaaS environment handling regulated consumer or financial data.
• Familiarity with policy-as-code (OPA, Kyverno), secrets management (Vault, KMS), and software supply chain security (SBOM, artifact signing).
• Experience building a team from a small base, defining processes, and operating a cadence where little existed.
• Exposure to securing AI/ML workloads and agentic systems.
• Relevant certifications such as CISSP, CCSP, CKS, or AWS Certified Security - Specialty.

Skills

AWS, ArgoCD, Azure, Docker, GCP, Jenkins, Kubernetes, Tekton, devsecops, infrastructure security, security engineering