Senior DevOps Engineer (DevSecOps) — CI/CD, Cloud & Security

wn the path from commit to production and the security posture of everything that path touches. The role carries architectural decision-making, operational ownership and mentorship — building pipelines engineers trust and infrastructure auditors accept. It explicitly includes hardening against AI-driven attacks and securing the attack surface created by the AI systems we build.

Key Responsibilities
CI/CD

•          Design and operate pipelines for JavaScript/TypeScript web and backend services and for mobile applications on both major platforms.

•          Build reusable pipeline templates and standards rather than bespoke pipelines per project.

•          Own mobile release automation — signing key custody, store submission, beta distribution, staged rollouts.

•          Embed security and quality gates in-pipeline: tests, the 80% coverage gate, SAST, DAST, dependency and container scanning, secrets scanning, IaC scanning.

•          Own container security — base-image strategy, registry controls, image signing, promotion workflows.

•          Generate SBOMs per release; maintain reproducible builds and artefact management.

•          Support progressive delivery — feature flags, canary releases, automated rollback.

•          Publish and improve DORA metrics.

Cloud (AWS)

•          Own the AWS estate — networking, compute, container services, managed databases, storage, CDN, DNS, queues, secrets and key management.

•          Everything as code in Terraform with remote state, reusable modules, peer-reviewed plans and drift detection. No console-only changes in production.

•          Multi-account structure with least-privilege IAM via role assumption; eliminate long-lived access keys.

•          Kubernetes security where applicable — RBAC hardening, admission control, network policies.

•          Cost engineering, including GPU scheduling and autoscaling for AI inference workloads.

•          Backup and disaster recovery with defined RPO/RTO and tested restore drills.

•          Observability — metrics, centralised logging, distributed tracing, actionable alerting, on-call rotation and runbooks.

•          Ensure data residency compliance where contractually or legally required.

Network and firewall

•          Manage perimeter and internal controls — security groups, network ACLs, WAF, DDoS protection, host-level firewalls.

•          Manage next-generation firewall appliances at office and client sites under change control, with periodic rule review.

•          Segment networks into public, private and data tiers with zero standing SSH exposure.

•          Manage VPN and site-to-site connectivity; automate TLS certificate lifecycle.

Server hardening and vulnerability management

•          Harden to CIS Benchmarks for hosts, containers and Kubernetes; enforce via configuration management and verify continuously.

•          Immutable golden images, automated patching with severity-based SLAs, EOL tracking.

•          Runtime security — host intrusion detection, file integrity monitoring, container runtime protection, mandatory access control.

•          Secrets management with rotation; zero secrets in repositories, images or CI logs.

•          Risk-based vulnerability management with remediation SLAs and MTTR dashboards.

•          Coordinate third-party penetration testing; own incident response, playbooks and statutory reporting timelines.

AI security

•          Defend against AI-enabled attacks — automated vulnerability discovery, polymorphic malware, deepfake-assisted social engineering, and fraud automation at machine speed.

•          Lead AI threat modelling covering prompt injection (direct and indirect), jailbreaking, model poisoning, training-data extraction, tool and memory poisoning, and excessive agency.

•          Engineer guardrails — input validation, output filtering, treating model output as untrusted, scoped tool permissions, human-in-the-loop for consequential actions.

•          Secure inference endpoints with authentication, rate limiting and resource-exhaustion controls; secure RAG and vector-store infrastructure against poisoning.

•          Build AI-specific monitoring covering prompt behaviour, tool invocation patterns and output anomalies.

•          Harden biometric and identity workflows against synthetic media and presentation attacks.

•          Apply OWASP Top 10 for LLM Applications, NIST AI RMF and MITRE ATLAS; govern internal AI coding assistants.

Enablement

•          Provide paved-road tooling so secure defaults are the easy path for developers.

•          Run threat modelling for high-impact changes; mentor engineers on cloud-native and DevSecOps practice.