DevSecOps Engineer

Secure the GitLab CI/CD pipeline end-to-end — protect runner environments, restrict pipeline permissions, enforce branch protection and MR approvals.

Integrate SAST, DAST, dependency scanning, container scanning, and secret detection natively into GitLab CI. Own the triage and remediation workflow.

Implement IaC security scanning (tfsec, Checkov) as a mandatory pipeline gate for all Terraform changes.

Manage GitLab token hygiene — enforce expiry policies, rotate project tokens, and audit personal access token usage.

Define and enforce pipeline security policies organization-wide using GitLab security policy-as-code.

Audit and reduce the external attack surface — inventory all public endpoints and drive internalization of services that do not need to be public.

Implement and maintain WAF and Cloud Armor rules to protect externally exposed services.

Enforce TLS certificate management — automate issuance, rotation, and enforce TLS 1.2+ across all endpoints.

Manage bastion host security — enforce short-lived certificates (OS Login / IAP), eliminate persistent SSH keys, and log all administrative sessions.

Own DNS security controls — DNSSEC, private DNS zones for internal services, split-horizon DNS where required.

Build security automation pipelines — policy enforcement, compliance checks, and vulnerability remediation as code.

Instrument security observability in Datadog — threat detection dashboards and alert tuning for cloud and Kubernetes signals.

Develop and maintain runbooks for security incidents, vulnerability response, and access reviews.

Champion security training and awareness. Conduct secure code reviews and threat modelling workshops.

GCP — Security Command Center, IAM, VPC Service Controls, Cloud Armor, Secret Manager, Binary Authorization

AWS — GuardDuty, Security Hub, IAM, KMS, Macie, AWS Config

Kubernetes — GKE hardening, pod security standards, network policies, RBAC, admission controllers

GitLab — CI/CD security, SAST/DAST, dependency scanning, pipeline policy management

Terraform — IaC security scanning (tfsec, Checkov), secure module design

Datadog — security monitoring, threat detection, alert management

Istio — mTLS, authorisation policies, service mesh security

Falco, OPA/Gatekeeper, HashiCorp Vault, Wiz/Orca/Prisma Cloud, Trivy/Snyk, SIEM (Splunk/Chronicle), Python or Go

Certified Kubernetes Security Specialist (CKS).

Google Professional Cloud Security Engineer or AWS Security Specialty certification.

eBPF-based security tooling (Cilium, Tetragon), penetration testing, or red team experience.

Threat modelling using STRIDE or PASTA. Service mesh security beyond Istio.

All your information will be kept confidential according to EEO guidelines.