DevSecOps Engineer

Description

The company is a luxury group that owns several Houses making jewelry, watches and high-end accessories. Each House keeps its own style, quality and craft heritage, while new products are designed in line with those values.

The role sits in the Governance & Architecture team inside the Cloud & DevOps Services department.

You will help secure the software delivery lifecycle so that code can be built and shipped quickly and safely. You will help design, build and keep improving security frameworks, acting as the link between development and operations.

Responsibilities

• Help build out and improve a full set of tools and processes for cloud security and DevSecOps across people, process and technology, including secret detection, SAST, SCA and container security.
• Create and roll out security controls that follow the organisation's security policies and procedures across the software delivery lifecycle.
• Automate how these controls are implemented and tested.
• Track how well the controls work and adjust them when needed.
• Look into security incidents linked to controls and resolve them.
• Give hands-on guidance to engineering and project teams on applying controls, guidelines and best practices.
• Drive closer collaboration between product teams, cybersecurity and compliance, helping measure risk and set control objectives and activities that protect cloud workloads.
• Take part in cloud and DevOps security governance, including committees, dashboards with KPIs, and sharing knowledge with other teams.
• Work on your own initiative: understand functional and technical needs, spot gaps and propose improvements.

Requirements

• Prior work in an SSDLC setting, with a record of designing and delivering effective security solutions and handling security problems.
• Understanding of security controls and frameworks, including preventive, detective and corrective controls, and frameworks such as the CIS Controls and the NIST Cybersecurity Framework.
• Knowledge of the SDLC and of where and how to apply security controls in each phase.
• Familiarity with application security risk frameworks such as the OWASP Top 10 for web applications and APIs, and with secure software development lifecycle practice.
• Experience with CI/CD and automation tools such as GitLab CI, Jenkins and AWX, plus scripting in Python or Go mainly, to understand where controls fit and to automate them.
• Knowledge of cloud security on AWS, Alibaba Cloud and GCP (GCP preferred), and of Kubernetes security, as these underpin the company's stack.
• Strong problem-solving skills to find and fix security issues that come up while controls are being built.
• Clear communication with developers, security engineers and other stakeholders.
• A drive to keep learning and to follow new security trends and technologies, as the field changes constantly.
• Fluent English. French is a plus.