DevSecOps Engineer - #1581

Role Overview

The successful candidate will work closely with software development teams, solution architects, cybersecurity stakeholders, and platform teams to implement approved infrastructure designs, support application onboarding onto MCC, enable integration through a common enterprise integration hub, and help software teams understand and remediate security findings generated by platform-provided controls.

This role does not involve designing, building, or maintaining the underlying MCC CI/CD pipelines, DevSecOps platform, or security scanning toolchains. These capabilities are provided and managed by the MCC platform team.

The candidate should also demonstrate a willingness and aptitude to learn full stack web application development to support experimentation, proof-of-concept initiatives, and platform capability enhancement activities.

Key Responsibilities

Cloud Platform & Application Onboarding

• Work with software development teams to onboard applications onto the MCC platform.

• Configure and utilise approved CI/CD pipelines and deployment processes provided by the MCC platform team.

• Provision and deploy cloud infrastructure in accordance with approved solution architecture designs and implementation specifications.

• Configure and maintain application deployment artefacts, environment configurations, and infrastructure definitions.

• Collaborate with solution architects, platform teams, cybersecurity stakeholders, and software development teams to resolve deployment, security, compliance, and operational issues.

• Automate operational and deployment-related tasks through scripting and approved automation tools where appropriate.

System Integration & Enablement

• Work with multiple software development teams to onboard and integrate their applications and services through a common enterprise integration hub.

• Configure and support connectivity between applications and the enterprise integration platform using approved integration services, configurations, and patterns.

• Support API onboarding, configuration, testing, deployment, and operationalisation activities.

• Troubleshoot and resolve integration-related issues across interconnected systems and services.

• Assist software teams in adopting integration standards, governance requirements, and operational practices established by platform and architecture teams.

• Develop and maintain integration-related documentation, interface configurations, and operational procedures.

• Support testing and validation of integrated application workflows across multiple systems.

Monitoring & Cloud Operations

• Configure, deploy, and maintain cloud monitoring, logging, and alerting solutions.

• Monitor cloud infrastructure and applications to ensure availability, reliability, and operational visibility.

• Investigate alerts, anomalies, and operational issues, and coordinate with relevant stakeholders to perform troubleshooting and remediation.

• Develop dashboards, metrics, and reports to provide visibility into system health, performance, utilisation, capacity, and operational status.

• Support incident detection, root cause analysis, service restoration, and post-incident improvement activities.

• Monitor cloud-hosted workloads and work with relevant teams to address operational issues in a timely manner.

Security & Compliance

• Understand security controls and checks provided by the MCC platform, including:

  • Static Application Security Testing (SAST)

  • Dynamic Application Security Testing (DAST)

  • Software Composition Analysis (SCA)

  • Container Vulnerability Scanning

  • Infrastructure and Configuration Compliance Checks

• Review and interpret security findings generated by platform-provided security controls.

• Work closely with software development teams to investigate, prioritise, track, and remediate identified vulnerabilities and compliance issues.

• Provide guidance to software teams on platform security requirements, secure coding practices, and vulnerability remediation approaches.

• Support security accreditation, compliance assessments, audits, and technical reviews.

• Develop and maintain deployment documentation, operational procedures, security-related artefacts, and technical records.

Experimentation & Prototyping

• Explore, prototype, and develop full stack web applications and platform capabilities for experimentation, proof-of-concept initiatives, and process improvement efforts.

• Learn and apply frontend, backend, API, and database technologies to support evolving platform and user requirements.

• Support lightweight experimentation to improve platform usability, reporting, automation, and developer experience.
  

Required Qualifications

• Degree in Computer Science, Computer Engineering, Information Security, Information Systems, Software Engineering, or a related discipline.

• Relevant security certifications such as:

  • CompTIA Security+

  • CSSLP

  • CISSP

  • or equivalent

• AWS certifications such as:

  • AWS Certified Solutions Architect (Associate or Professional)

  • AWS Certified Developer

  • AWS Certified SysOps Administrator

  • AWS Certified DevOps Engineer

• Cloud and container certifications such as:

  • Certified Kubernetes Administrator (CKA)

  • Certified Kubernetes Application Developer (CKAD)

  • Certified Kubernetes Security Specialist (CKS)

Technical Skills & Experience

• Strong hands-on experience with AWS cloud services, including:

  • Networking

  • Compute Services

  • Storage Services

  • Identity and Access Management (IAM)

• Strong hands-on experience with Amazon API Gateway, including API configuration, deployment, integration, routing, security controls, and troubleshooting.

• Familiarity with Amazon API Gateway Mapping Templates and Velocity Template Language (VTL).

• Demonstrated competency with AWS cloud services. Relevant AWS certifications may be used as evidence of technical competency.

• Experience working with CI/CD platforms such as GitLab, Jenkins, Azure DevOps, or equivalent.

• Familiarity with containerisation and orchestration technologies such as Docker and Kubernetes.

• Understanding of Secure Software Development Lifecycle (SSDL) principles.

• Experience interpreting and analysing findings generated by security tools such as SAST, DAST, SCA, container scanning, and compliance scanning solutions, and working closely with software development teams to investigate, track, and remediate identified issues.

• Experience configuring and managing cloud monitoring, logging, and alerting solutions.

• Experience monitoring cloud-hosted applications and infrastructure, including investigation and resolution of operational issues.

• Familiarity with AWS monitoring and observability services such as Amazon CloudWatch, CloudTrail, AWS Config, Amazon Managed Prometheus, Amazon Managed Grafana, or equivalent solutions.

• Knowledge of cloud infrastructure concepts, including networking, compute, storage, identity and access management, monitoring, and security controls.

• Experience with scripting languages such as Python, Bash, or PowerShell.

• Ability to work with multiple software development teams to support application onboarding, integration testing, troubleshooting, and operationalisation activities.

• Experience working within defence, government, or other regulated environments.

• Experience supporting application migration or onboarding to enterprise cloud platforms.

• Experience supporting accreditation, compliance, governance, or audit activities.

• Experience deploying infrastructure using Infrastructure as Code (IaC) tools such as Terraform, OpenTofu, Ansible, or equivalent.

• Exposure to full stack web application development, including frontend frameworks, backend services, APIs, and database technologies.

• Demonstrated willingness and aptitude to learn new technologies and development frameworks, including full stack web application development.

• Strong analytical, troubleshooting, communication, and stakeholder management skills.