Senior DevSecOps Engineer, Cybersecurity

Description

The company practises independent journalism across print, audio, and digital and app platforms, with journalists reporting from nearly 160 countries.

This hands-on role sits on the Security Architecture team and reports to the Director of Engineering, Cybersecurity.

You will own complex security initiatives from start to finish, measure how much risk they remove, and work with product engineering and enterprise technology teams.

The cybersecurity group protects journalists and their support staff, the platforms they use daily, the company's products and services, and its readers.

Responsibilities

• Give product engineers the context and tools they need to ship secure products and services, rather than acting as gatekeepers.
• Build, run, and improve security controls such as identity and access management, secrets management, endpoint and agent hardening, network segmentation, and automated detection and response, meeting set standards for reliability, security, scale, and observability.
• Work with product and platform teams to build security into architecture and developer workflows, explaining business impact and trade-offs.
• Run security reviews, threat models, and risk assessments covering code, design, and third-party applications.
• Handle urgent and complex security issues, triage them well, and drive architecture changes that stop them recurring.
• Share learning through RFCs, practice communities, and internal channels, help set standards, shape secure patterns across teams, and model the company's core values in cross-team work.
• Grow colleagues through peer design and code reviews, pairing, and clear feedback on security engineering practice across the department.
• Show support for journalistic independence and for the company's aim of truthful reporting that helps readers make sense of events.

Requirements

• You have at least 5+ years of experience in software engineering and security engineering.
• You understand security controls across access management, encryption, vulnerability management, AI security, network security, and authentication and authorization.
• You know one or more cloud platforms, such as AWS or GCP, and how to architect and secure them.
• You have worked with CI/CD, GitOps, infrastructure as code, and security practices such as SAST, SCA, secure by design, and shift left.
• You program in at least one language, such as Go or Python.
• You have experience with containerization and orchestration platforms.
• You want to help people, since many teams will depend on you to build their systems.
• Preferred: security, compliance, or DevOps certifications.
• Preferred: experience with Kubernetes.
• Preferred: experience with Terraform and Packer.
• Preferred: experience with HashiCorp Vault.

Conditions

Limited on-call hours may be required, and the schedule is set when you join, based on team size and other factors.

This is a hybrid role combining remote and in-office work.

For U.S. roles, the annual base pay range is $140,000 to $160,000 USD.

The company is an equal opportunity employer and does not discriminate based on sex, age, race, color, creed, national origin, alienage, religion, marital status, pregnancy, sexual orientation, gender identity and expression, disability, genetic trait, carrier status, citizenship, veteran or military status, or other legally protected characteristics.

Benefits

• Depending on the role, U.S. positions may be eligible for variable pay such as an annual bonus and restricted stock.
• U.S. benefits may include medical, dental, and vision cover, flexible spending accounts, a company-matching 401(k) plan, and an employee stock purchase plan.
• U.S. benefits may also include paid vacation, paid sick days, paid parental leave, tuition reimbursement, and professional development programs.
• Outside the U.S., benefit details are shared during the interview process.