Architect - DevOps 4D

Application Code Security (Primary Accountability)

Design, implement, and enforce the mandatory SAST (Static Application Security Testing) scanning pipeline for all NH2030 code before Databricks deployment

Configure GitHub Advanced Security (or equivalent) for the NH2030 GitHub repositories: code scanning, secret scanning, and dependency review

Define and enforce the code review process including OWASP Top 10 compliance checks for all application code

Own the security gate in the CI/CD pipeline: no deployment proceeds without a passing security scan

Triage and remediate security findings from SAST scans; track findings to closure in the security register

Conduct periodic security reviews of notebooks, Python/PySpark scripts, and DLT pipeline code for common vulnerabilities

Library & Dependency Management

Establish and maintain the approved library list for NH2030 workloads on both classic and serverless Databricks compute

Implement dependency pinning across all NH2030 project requirements files (requirements.txt, pyproject.toml, etc.) to prevent supply chain attacks

Run regular vulnerability scans on all library dependencies using tools such as Dependabot, Snyk, or Safety

Coordinate with ADP Platform Team to request library and init script whitelisting for classic compute

Ideally establish and maintain an internal Nexus/Artifactory proxy repository stocked with pre-vetted, trusted libraries for NH2030 teams

For serverless compute: since no centralised restriction is possible, own full end-to-end responsibility for dependency vetting, pinning, and vulnerability management

Review and approve all init script and JAR file whitelisting requests before submission to ADP team

GitHub Repository Security & Connectivity

Identify all GitHub repositories required by the NH2030 programme for Databricks Git integration

Submit and manage workspace-level GitHub repository whitelisting configuration (ADP default: no repos whitelisted)

Configure branch protection rules, required review policies, and CODEOWNERS on NH2030 repositories

Monitor repository access and audit logs for unauthorised access or anomalous activity

FQDN Whitelisting & Egress Security

Identify and document all external FQDNs required by NH2030 serverless and classic compute workloads

Prepare and submit FQDN whitelisting requests via ServiceNow: classic compute to FCP Azure Firewall, serverless compute to ADP network policies

Validate that whitelisted FQDNs are the minimum required (least-privilege egress principle)

Review FQDN requests from development teams to ensure they are justified and do not introduce risk

Monitor for unauthorised egress attempts in ACDC SIEM logs and Dynatrace dashboards

Workspace Security Configuration

Verify and document that DBFS and Hive Metastore are disabled in the NH2030 Dev workspace (mandatory ADP control)

Review and tighten data exfiltration prevention controls: restrict file export, notebook download, clipboard access, and MLflow artifact export per NH2030 data classification requirements

Validate that ADP-provisioned default restrictions are active and configure additional controls as required by NH2030 data sensitivity

Review cluster policy configurations to ensure they enforce secure compute settings

BYOS Storage Security (in coordination with Azure Cloud Engineer)

Define BYOS security requirements based on NH2030 data classification: Defender enablement, CMK scope, WORM requirements, SAS token policy

Review and sign off on BYOS security control configurations implemented by the Azure Cloud Engineer

Ensure Malware Scanning is active on all BYOS storage accounts and define the alert response procedure

Validate container-level ACLs and access policies against the principle of least privilege

SIEM & Security Monitoring

Define and document the Genpact incident response process for ACDC SIEM security alerts received for the NH2030 Dev workspace

Monitor ACDC/Google SecOps dashboards for NH2030 workspace security events; triage and respond to alerts within agreed SLA

Contribute to security alert definition and log forwarding configuration with ADP Platform Team

Set up SQL Alerts in Databricks for access anomaly detection and unusual query patterns

Security Readiness & Compliance

Lead the Security & Compliance Readiness Review (P10-04) prior to Dev environment sign-off

Maintain a security configuration checklist covering all OE security obligations under the Platform Security Shared Responsibility Model

Conduct periodic security posture reviews throughout the development phase

Provide security guidance to NH2030 developers on secure coding practices for Databricks

Escalate unresolved security findings to NH2030 Programme Governance and ADP Platform Team as required

Primary Security Activities

Governance & Review Activities

SAST code scanning pipeline (mandatory pre-deployment) – P5-04

Library & package security – dependency pinning, vulnerability scanning – P5-03

GitHub repo whitelisting in workspace – P5-01

FQDN whitelisting request preparation – P5-02

BYOS security controls sign-off (Defender, CMK, WORM, SAS) – P5-07

Exfiltration prevention controls – export/download/clipboard restrictions – P5-06

DBFS / Hive Metastore lockdown verification – P5-05

ACDC SIEM alert response process definition – P7-04

Security & Compliance Readiness Review (pre-Dev sign-off) – P10-04

Application code security ownership (OWASP Top 10) – per SRM

App dependency management for Databricks Apps – per SRM

CI/CD security gate (SAST in pipeline) – P9-03

Core Security Skills

Supporting Skills

3+ years DevSecOps or application security engineering in cloud environments

SAST tooling: GitHub Advanced Security, SonarQube, Semgrep, or equivalent

OWASP Top 10: understanding and practical remediation in Python/PySpark contexts

Dependency management: pip, poetry, Dependabot, Snyk, Safety, or equivalent

GitHub repository security: branch protection, CODEOWNERS, secret scanning

Azure Defender for Storage, Microsoft Defender for Cloud

SIEM platforms: Google SecOps (ACDC), Splunk, or equivalent

Supply chain security: package pinning, Nexus/Artifactory proxy repository management

Databricks security model: workspace admin controls, DBFS/Hive lockdown, exfiltration prevention

Azure networking security: FQDN whitelisting, Azure Firewall, NSG

CMK and Key Vault security for storage encryption

CI/CD pipeline integration (GitHub Actions / Azure DevOps) for security gates

Data classification and tagging principles for regulated data environments

Incident response process design and runbook development

Experience in financial services or insurance sector security requirements (advantageous)

Familiarity with Allianz ARS framework / Wiz CSPM (advantageous)

GitHub Advanced Security Certification (required)

SC-100 Microsoft Cybersecurity Architect or SC-200 Security Operations Analyst (desirable)

CEH (Certified Ethical Hacker) or equivalent offensive security certification (desirable)

CISSP or CISM (desirable for senior candidate)

Databricks workspace security knowledge (no dedicated cert – demonstrated experience)

Lead Databricks Platform Engineer: Cluster policy security settings, DBFS/Hive lockdown verification, workspace exfiltration controls, Git integration security

Azure Cloud Engineer: BYOS security controls alignment, CMK and Defender configuration sign-off, FQDN whitelisting coordination

ADP Platform Team (AzTech): Library allowlisting requests, FQDN whitelisting submission, ACDC SIEM log forwarding configuration

ACDC / Allianz Security Team: SIEM alert triage and escalation, security incident response

All NH2030 Developers: Code review guidance, secure coding standards, SAST scan remediation support

NH2030 Programme Governance: Security compliance reporting, readiness review sign-off