Principal Engineer, DevSecOps

As a senior technical leader within the engineering practice, the Principal Engineer, DevSecOps owns the health, security and evolution of the AWS estate that OFX's payments, client-facing applications and internal systems run on. You will set the direction for how cloud infrastructure, delivery pipelines and security controls are designed, built and operated across OFX Engineering.
Your primary responsibility is to build and run the paved road: a secure, standardised and automated platform (GitHub Actions, scanning and policy-as-code) that lets engineering teams ship production-ready services with minimal friction, while security, compliance and reliability are engineered in rather than bolted on.
You will work together with the Engineering Directors, engineering managers, principal engineers, tech leads, the Security team and Technology Operations to deliver impactful outcomes for OFX. You will design, build and maintain the secure paved road for engineering. You will also review infrastructure and pipeline changes from other engineers, mentor teams on cloud and security practice, and help shape the platform and security roadmap.
The Principal Engineer, DevSecOps strives to achieve the highest levels of engineering practice, operational excellence and security posture. You will be hands-on, leading by example in code, design and incident response, and setting standards that others adopt because they make the work easier and safer.
In addition to deep technical expertise, you will need strong influencing skills: building relationships with engineering and security stakeholders, explaining trade-offs to technical and non-technical audiences, and leading without needing the line-management title.
10+ years hands-on experience designing, building and operating production AWS workloads, including multi-account setups, VPC networking, IAM, Lambda, containers (ECS/Fargate), RDS and observability tooling in a medium to large Enterprise.
10+ years GitHub Actions experience across application and infrastructure pipelines, with secure credential handling medium to large Enterprise.
A genuine software engineering background in at least one general-purpose language (TypeScript, Python, Go or C#), with tests, code review and release discipline as habit.
Demonstrable cloud security engineering, including least-privilege IAM, RBAC, SSO, MFA, secrets management and remediation using CSPM tooling such as Wiz.
Experience embedding security controls into pipelines (SAST, SCA, secrets, container and IaC scanning, policy-as-code).
Experience automating compliance evidence against frameworks such as ISO 27001, SOC 2, PCI DSS and the AWS Well-Architected Framework.
A track record leading incidents and post-incident reviews under real change control.
Experience working with event-driven, serverless or distributed architectures, ideally in SaaS or fintech.
Clear communication skills, including writing design documents and explaining trade-offs to technical and non-technical stakeholders.
Availability for an on-call rotation and occasional out-of-hours maintenance.
AWS Professional or relevant Security certification;
Desirable: Experience in a regulated financial services or payments environment; contribution to a penetration test remediation or certification cycle.

Employment type
Full-time

Work arrangement
Yes