DevSecOps Engineer
hilti
Job Description
- Senior DevOps engineering foundation: Design, build, and improve reliable, scalable, and automated AWS, Kubernetes/EKS, Infrastructure as Code, and CI/CD capabilities while applying security as an integrated engineering requirement.
- DevSecOps capability ownership: Drive practical adoption of secure software delivery practices across product teams, translating enterprise security, architecture, and compliance requirements into reusable engineering controls and implementation patterns.
- Secure CI/CD and policy enforcement: Embed automated security checks, approvals, evidence, and policy enforcement into GitLab CI/CD and related delivery workflows while keeping controls understandable, maintainable, and proportionate to risk.
- Application and dependency security: Implement and improve static analysis, software composition and open-source dependency scanning, vulnerability detection, secrets detection, artifact controls, and actionable remediation workflows using approved tools.
- Software supply chain security: Strengthen provenance, artifact integrity, dependency governance, build security, access boundaries, and traceability across source, pipeline, registry, deployment, and runtime stages.
- IAM governance and automation: Engineer reusable IAM patterns, least-privilege controls, role and access lifecycle automation, secrets/configuration management, access reviews, and evidence collection across AWS and delivery platforms.
- Cloud, container, and infrastructure security: Implement secure AWS, Kubernetes/EKS, network, workload, container, and Infrastructure as Code patterns, including scanning, hardening, admission controls, policy as code, and remediation automation.
- Vulnerability remediation enablement: Partner with product teams and security stakeholders to triage findings, clarify ownership and risk, prioritize remediation, remove false-positive noise, track exceptions, and drive high-value actions to verified closure.
- Compliance and audit readiness: Automate control evidence where practical, improve traceability, support ISO 27001 and related assurance needs, and maintain clear documentation for security controls, exceptions, decisions, and remediation status.
- Security enablement and influence: Coach engineers, create practical standards and examples, facilitate threat-aware design and secure delivery discussions, and influence teams without becoming a manual approval bottleneck.
- Operational security partnership: Support investigation and long-term corrective actions for security-related production issues in partnership with SRE, Architecture, Security, and responsible product teams.
- Other duties: Perform other related duties as needed or assigned.