Lead DevSecOps Engineer

Description

The company is a Fortune 10 business in healthcare that offers insights, products and services aimed at making quality care easier to access and more affordable.

The team values growth, impact and new ideas, and wants people who want to help shape the future of health.

Responsibilities

• Lead application security and DevSecOps work across cloud, on-premises and hybrid environments.
• Build security controls into CI/CD pipelines and developer platforms, and make them scalable.
• Roll out and run security tools such as GitHub Advanced Security, OWASP ZAP, Veracode and SonarQube.
• Lead software supply chain security using tools like JFrog Xray/Curation, Black Duck, Sonatype and FOSSA.
• Write automation and security integrations in Python, Bash, JavaScript or similar languages.
• Work with engineering and platform teams to make applications, APIs, containers and cloud workloads secure by design.
• Lead technical response during security incidents, vulnerability management and remediation.
• Mentor engineers and shape enterprise security architecture, standards and roadmaps.
• Create and maintain security standards and controls for Kubernetes, containers, Terraform and cloud-native platforms.
• Build security automation, policy-as-code and self-service security tools that suit developers while lowering organizational risk.

Requirements

• Have 10+ years of progressive experience in cybersecurity engineering, application security, DevSecOps, cloud security or a related field.
• Hold a bachelor's degree in Computer Science, Cybersecurity, Information Technology or Engineering, or have equivalent experience.
• Have run enterprise-scale security tools such as GitHub Advanced Security, SonarQube and/or OWASP ZAP.
• Have worked with software supply chain and open-source risk tools such as JFrog Xray/Curation, Black Duck, Sonatype or FOSSA.
• Be proficient in scripting and automation with Python, Bash, JavaScript or similar.
• Have designed and secured CI/CD pipelines on GitHub Actions, Jenkins, GitLab CI, Azure DevOps or comparable platforms.
• Have hands-on experience securing cloud environments on AWS, Azure and/or GCP.
• Have worked with Docker and Kubernetes.
• Have managed enterprise source code platforms such as GitHub or GitLab, developer ecosystems and software delivery infrastructure.
• Preferred: a master's degree in Cybersecurity, Computer Science or a related field.
• Preferred: experience implementing policy-as-code, infrastructure-as-code security and automated security guardrails.
• Preferred: experience with threat modeling, secure code reviews and application security testing methods.
• Preferred: knowledge of zero-trust architecture, identity security, cryptography and cloud-native security controls.
• Preferred: experience building security metrics, dashboards and executive reporting.
• Preferred: relevant certifications such as CISSP, CCSP, CSSLP, AWS Security Specialty, Azure Security Engineer or GIAC.
• Preferred: experience leading large security transformation programs in highly regulated environments.
• Preferred: experience mentoring engineers and acting as a technical leader across several teams.
• Preferred: experience securing Kubernetes platforms, container registries and cloud-native application environments.
• Preferred: experience with software supply chain controls such as artifact signing, SBOM management, provenance, dependency governance and secure builds.

Conditions

Base pay range for this position is €82,500 - €137,500.

Pay depends on performance, experience and skills, equity, regular job market reviews and geographic market, and will always comply with applicable regulations.

Annual bonus or long-term incentive opportunities may be offered in addition to base pay.

Benefits

• A Total Rewards package with comprehensive benefits covering physical, mental and financial well-being.
• A competitive compensation package.