DevSecOps Engineer

Were seeking a DevSecOps Engineer to own the secure delivery pipeline and platform foundations across cloud environments. Youll design and automate IAM infrastructure as code (Terraform) CI/CD (GitHub Actions) and Kubernetes operations embedding security controls by default and enabling development teams to ship quickly and safely.

Your Assignment at aGlance

• Design and implement least-privilege IAM (users roles policies SSO/OIDC) across cloud and Kubernetes (RBAC service accounts Pod Security Standards).
• Build/maintain Terraform modules and environments (prod/non-prod) enforce drift detection and apply policy-as-code (OPA/Conftest Sentinel Checkov/tfsec).
• Own GitHub Actions pipelines (build/test/scan/sign/release) reusable workflows environment protections required reviews and deployment gates.
• Operate Kubernetes clusters (EKS/AKS/GKE or on-prem): cluster lifecycle Helm/Kustomize GitOps (Argo CD/Flux) NetworkPolicies ingress secrets.
• Embed software supply chain security: SCA/SAST/DAST container/IaC scanning SBOM generation image signing (Cosign) provenance (SLSA).
• Implement secret management (Vault/Secrets Manager/KMS) key rotation and secure parameter stores.
• Stand up observability: metrics logs traces (Prometheus/Grafana/ELK/Cloud-native) and actionable alerts.
• Automate incident response runbooks; support on-call for platform/security events.
• Partner with AppSec and product teams on threat modeling secure design reviews and remediation.
• Contribute to compliance initiatives (SOC 2/ISO 27001) with evidence automation and configuration baselines.
• Drive cost reliability and capacity guardrails; champion platform DX and documentation.

What We Need From You

• 8 years in DevOps/Platform/SRE with a security-first mindset.
• Strong IAM design (cloud Kubernetes RBAC) OIDC/OAuth2 SSO/IdP (e.g. Okta/Azure Entra).
• Production Terraform experience (workspaces modules remote state CI-driven plans/applies).
• Hands-on GitHub Actions (self-hosted runners OIDC to cloud environments/protections matrix builds).
• Operating Kubernetes in production (Helm networking ingress autoscaling upgrades backups/DR).
• Practical use of security scanners (e.g. Wiz Trivy/Grype Dependabot Checkov/tfsec) and policy-as-code.
• Proficient with one or more clouds (AWS) Linux containers and networking fundamentals.
• Strong scripting in Python or Bash; Infrastructure troubleshooting and debugging skills.
• Clear communication ownership and ability to drive cross-team initiatives.

  
  Nice to Have

  • HashiCorp Vault keeper/Kyverno service mesh (Istio/Linkerd) or CNI like Cilium.
  • GitOps at scale (Argo CD multi-app/multi-cluster) progressive delivery (Argo Rollouts/Flagger).
  • Experience with SIEM detections or security data pipelines.
  • Knowledge of data protection (PII) tokenization and regional compliance.
  • Background in financial/insurance/auto domains (regulated environments).

Physical and Environmental Requirements
The physical requirements described here are representative of those that must be met by a Contractor to successfully perform the essential functions of the job. While performing the duties of the job the Contractor is required on a daily basis to analyze and interpret data communicate and remain in a stationary position for a significant amount of the work day and frequently access input and retrieve information from the computer and other office productivity devices. The Contractor is regularly required to move about the office and around the corporate campus. The Contractor must frequently move up to 10 pounds and occasionally move up to 25 pounds.

Travel Requirements

• up to 20%

If you have a disability and would like to request an accommodation please contact us at We celebrate diversity and are committed to creating an inclusive environment.

We are seeking candidates legally authorized to work in the United States without Sponsorship.

#LI-TW1