Senior DevSecOps / Platform Security Engineer

About the role

We are hiring a hands-on Security Engineer, a DevSecOps / Platform Security Engineer to build the shared "secure paved road" for a portfolio of GenAI applications delivered across several product streams. Your job is to make the secure way the default way: run security tools and remediate for and with the project team findings in IaC, back- and front-ends, build reusable pipeline, container, and dependency-management templates that every stream inherits, so security is built in at delivery time rather than bolted on afterward.

What you'll do

• Run advanced security tools and manage the results.
• Threat models the application with the team.
• Improve on CI/CD security.
• Remediate security findings.
• Bar-raise software supply chain security.
• Package everything as reusable templates plus short "how and why" guidance so the paved road spreads without you in the loop for every repository.

What you'll bring (required)

• Senior-level engineering maturity — sets standards, drives adoption across teams, and owns security outcomes end-to-end together with the team and higher level security leadership.
• Strong, current software engineering / coding ability — you write and review Python code, not only edit configuration. A portfolio, repository, or code sample you can walk us through.
• Hands-on CI/CD engineering, ideally Jenkins (pipelines and shared libraries).
• Container security in practice: multi-stage, digest-pinned, non-root Docker images; understanding of image attack surface.
• Python and/or Node dependency & supply-chain know-how: lockfiles, hash pinning, safe index resolution, dependency scanning.
• AWS security engineering: least-privilege IAM, secrets management, and hardening of container/serverless workloads.
• Practical secret management and secret scanning, including pre-commit gating.
• Experience integrating SAST / SCA / IaC scanning into pipelines as enforced gates, with sensible false-positive tuning.
• Solid TLS / PKI fundamentals.
• Comfort using AI coding agents (e.g. Kiro, Claude Code, Codex) as a daily tool to ship faster — with the judgment to review and verify their output.

Strongly preferred — Security Credentials

• AWS Security Specialty certification (AWS Certified Security – Specialty) is highly desirable.
• Alternatively, other strong industry security credentials — e.g. OSCP, CISSP, or equivalent deep technical security or security management credentials.

Nice to have

• Experience in a regulated environment (HCLS / pharma / GxP / HIPAA / GDPR).
• GenAI / LLM application exposure: managed model endpoints (e.g. Amazon Bedrock), retrieval-augmented generation, and the security considerations that come with them.
• Application-security depth (authN/authZ, tenant isolation, common web vulnerabilities).
• Familiarity with Bitbucket, an artifact registry, and Helm.