Senior DevSecOps Engineer

Job Description For DevSecOps Engineer
Role Summary
We are looking for a hands-on DevSecOps Engineer who can operate confidently across the full lifecycle: building and securing CI/CD pipelines, provisioning and hardening cloud infrastructure, keeping production services observable and available, and increasingly, weaving AI-assisted automation into day-to-day operations and incident workflows. This is not a purely build-and-forget role — the engineer will also be expected to jump into live production issues (network, connectivity, service restoration) and drive them to resolution, then close the loop by improving monitoring so the same issue is caught earlier next time.
Key Responsibilities
2.1 CI/CD, Pipelines-as-Code & Release Engineering
Author and maintain YAML-based pipelines in GitHub Actions and Azure DevOps (ADO) Pipelines, including reusable templates, approval gates, and environment-specific variable/secret handling.
Implement pipeline security controls (branch protection, signed commits, dependency/SCA scanning, artifact signing) as part of a shift-left approach.
Own release orchestration across dev/QA/staging/production, including rollback strategy and change-management alignment (JIRA-linked deployments).
2.2 Cloud, Containers & Infrastructure Provisioning
Provision and manage Azure services (AKS, App Services, networking, storage, IAM/RBAC) using Infrastructure-as-Code, with working exposure to AWS for multi-cloud or DR scenarios.
Operate containerized workloads — build, scan, and deploy Docker images; manage Kubernetes workloads on AKS (deployments, services, ingress, namespaces, autoscaling).
Administer supporting Windows infrastructure where applicable, including IIS site/application pool configuration, bindings, and certificate management.
2.3 Security Services & Compliance
Integrate security tooling into the pipeline and runtime — SAST/DAST/SCA, container image scanning, secrets management, and vulnerability remediation tracking.
Apply cloud security guardrails (NSGs/firewalls, Key Vault/Secrets Manager, least-privilege IAM, policy-as-code) across Azure and AWS resources.
Support audit and compliance activities with evidence gathering, access reviews, and documentation in Confluence.
2.4 Observability & Incident Response
Build and maintain Grafana dashboards and alerts (paired with a metrics/log backend) for application, infrastructure, and pipeline health.
Lead first-line troubleshooting for production incidents, for example:
Investigating host availability and tracing the network path for an external endpoint (e.g., xyz.com) from an internal application/execution server (DNS resolution, ping/traceroute, port-level checks, proxy/firewall hops).
Restoring service or connectivity when a host is unreachable on standard web ports — coordinating firewall/NSG rule fixes, web server (e.g., IIS) restarts, certificate/TLS checks, and DNS validation.
Validating downstream functionality post-fix (e.g., confirming report generation succeeds in a QA environment) and then updating monitoring/alerting, so the same failure mode is detected proactively next time.
Drive post-incident follow-through — root cause notes, JIRA updates, and monitoring/alert improvements so incidents convert into permanent detection or automation.
2.5 AI-Driven DevSecOps Workflows
Apply AI tooling to daily engineering work (AI coding assistants, log/anomaly summarization, pipeline log triage) to increase throughput and reduce manual toil.
Design and maintain AI-assisted ticket workflows: when a JIRA ticket is raised, an AI-driven automation should analyze the ticket, generate the recommended next steps/sub-tasks, and keep the ticket updated as the situation evolves (e.g., via JIRA REST API + an LLM-based automation/agent, triggered by webhooks or Automation for Jira).
Evaluate and pilot AI-driven pipeline capabilities — e.g., AI-assisted code/security review gates, auto-generated runbooks, and AI-suggested remediation for recurring alerts.
2.6 Collaboration, Documentation & Tooling
Track and manage work in JIRA, including incident, change, and automation-generated tasks.
Maintain runbooks, architecture notes, and SOPs in Confluence, keeping documentation current as pipelines and infrastructure evolve.
Write automation and tooling in Python for pipeline utilities, monitoring integrations, JIRA/Confluence API automation, and ad-hoc diagnostics.
Required Technical Skills (from role scope)
YAML & GitHub Actions: Define and maintain CI/CD workflows as version-controlled, reviewable, and automated deployment pipelines.
Azure DevOps (ADO) Pipelines: Orchestrate enterprise-grade build, test, and release processes across multiple environments.
Docker & Containerization: Build, package, scan, and run portable, consistent application workloads.
Azure Kubernetes Service (AKS): Deploy, manage, scale, and troubleshoot containerized production workloads.
AWS Exposure: Support multi-cloud strategies, disaster recovery scenarios, and workload-specific cloud deployments alongside Azure.
Azure Services Provisioning: Configure and manage compute, networking, storage, and identity resources, preferably through Infrastructure as Code (IaC).
Security Services: Implement and manage SAST, DAST, SCA, secrets management, cloud security posture management, and vulnerability remediation.
JIRA: Track incidents, changes, work items, and AI-assisted task management workflows.
Confluence: Maintain runbooks, standard operating procedures (SOPs), architecture documentation, and technical knowledge bases.
IIS (Internet Information Services): Configure, administer, troubleshoot, and maintain Windows-hosted web applications and services.
Grafana (Observability): Monitor infrastructure, application performance, logging, and alerting through centralized dashboards.
Python: Develop automation scripts, operational tooling, API integrations, and workflow automation for platforms such as JIRA, Confluence, and monitoring systems.
AI Tools & AI-Driven Workflows: Leverage AI assistants and automation capabilities to streamline DevOps processes, ITSM workflows, and tasks such as automated JIRA updates, ticket triaging, and operational insights.
Additional Expectations (Recommended Additions to the Role Scope)
The list below fills gaps that are implicit in the requirements above but weren't called out explicitly. A candidate strong on the items in Section 3 but weak here will still struggle in a real DevSecOps rotation — recommend including these in the JD and interview loop.
Infrastructure as Code (IaC): Terraform and/or Bicep/ARM for repeatable, auditable infrastructure provisioning.
Secrets & Key Management: Azure Key Vault, AWS Secrets Manager, or HashiCorp Vault.
SAST/DAST/SCA & Container Scanning: Experience with tools such as SonarQube, Snyk, Trivy, Checkmarx, or Aqua.
Networking Fundamentals: Strong understanding of DNS, TCP/IP, load balancers, reverse proxies, and firewall/NSG rule logic.
Linux & Windows Server Administration: Proficiency in administering both platforms, supporting IIS-based Windows services and Linux containerized workloads.
Observability Stack: Familiarity with Grafana and its underlying data sources such as Prometheus, Loki, Azure Monitor, or CloudWatch.
Certificate & PKI Management: TLS certificate issuance, renewal, troubleshooting, and SSL/HTTPS connectivity management.
Incident Management: ITIL-aligned incident response, severity classification, on-call support, and effective stakeholder communication.
Scripting & Automation: Python, PowerShell, and Bash for automation, operational tasks, and incident diagnostics.
Configuration Management (Nice-to-Have): Ansible or similar tools for managing host configuration and preventing configuration drift.
Compliance & Governance: Working knowledge of CIS Benchmarks, ISO 27001, SOC 2, and cloud/pipeline security controls.
Responsible AI Usage in ITSM: Governance and guardrails for AI-generated JIRA updates, including human review, audit trails, and rollback mechanisms.
Communication & Documentation: Strong documentation practices, runbook maintenance, incident reporting, and effective use of JIRA and Confluence.
Preferred Certifications: AZ-400 (Azure DevOps Engineer Expert), CKA, AWS Certified DevOps Engineer, AWS Security Specialty, Security+, or equivalent certifications.
Tools & Platforms at a Glance
Source Control & CI/CD: Git, GitHub Actions (YAML), Azure DevOps (ADO) Pipelines
Cloud Platforms: Microsoft Azure (primary for provisioning and AKS), AWS (secondary exposure)
Containers & Orchestration: Docker, Azure Kubernetes Service (AKS)
Web / Application Hosting: IIS (Windows-hosted services)
Security: SAST, DAST, SCA tooling, secrets management, cloud security posture management
Observability: Grafana with Prometheus, Azure Monitor, Loki, or other metrics/logging backends
ITSM & Collaboration: JIRA, Confluence
Scripting & Automation: Python (primary), PowerShell, Bash
AI / Automation: AI coding assistants, LLM-based JIRA automation for auto-generating next steps

Work arrangement
No