Staff DevOps Engineer - Docker/Kubernetes
Summary
Staff DevOps Engineer on the DevSecOps team in Bangalore, acting as the technical authority for platform security on a cloud-native stack. Day to day: define DevSecOps architecture, own the secure CI/CD paved road, and automate security controls across AWS/Azure/GCP and Kubernetes using OPA/Rego, Kyverno, and Vault/KMS.
Role Overview:
As a Staff DevOps Engineer on the DevSecOps team, you are the technical authority for how security is designed into the company's cloud-native platform. You will define the DevSecOps reference architecture, own the secure paved road from code commit to production, and set a multi-quarter technical roadmap for platform security.
Architecture & Technical Strategy:
- Security Architecture: Define and evolve the DevSecOps reference architecture and secure-by-design standards adopted across engineering - covering cloud infrastructure, Kubernetes, containers, and CI/CD.
- Technical Roadmap: Own the multi-quarter DevSecOps roadmap. Make and defend build-vs-buy, tooling-consolidation, and platform-investment decisions.
- Design Authority: Author and review design docs and RFCs for security-critical infrastructure.
- Ambiguity to Execution: Take loosely defined, multi-team security initiatives and decompose them into scoped, sequenced, executable roadmaps.
Platform & Pipeline Ownership:
- Secure Paved Road: Own the golden-path CI/CD pipeline - set gating policy, severity thresholds, and break-the-build rules.
- Shift-Left Automation: Drive SAST, DAST, SCA, IaC scanning, container image scanning, and secret detection into pipelines.
- Infrastructure Hardening: Design and automate security controls across AWS/Azure/GCP resources, Kubernetes clusters, and service meshes.
- Policy-as-Code: Establish and scale guardrails using OPA/Rego, Kyverno, and admission controllers.
- Supply-Chain Security: Own artifact provenance and integrity - SBOM generation, artifact signing, and dependency provenance.
- Secrets & Identity: Architect secrets management and workload identity at scale - Vault/KMS, dynamic credentials, and least-privilege IAM.
Detection, Response & Governance:
- Threat Detection: Design monitoring, alerting, and detection-as-code for infrastructure and pipeline security signals.
- Incident Leadership: Lead security incident triage and response for infrastructure and pipeline events.
- Vulnerability Management: Own the end-to-end vulnerability lifecycle at platform scale.
- Compliance Engineering: Translate SOC 2, ISO 27001, PCI-DSS, and GDPR/CCPA obligations into automated technical controls.
- Risk Arbitration: Frame security risk versus delivery velocity for engineering leadership.
Leadership & Influence:
- Cross-Org Leadership: Co-own security standards with Cloud Security and Product Security.
- Mentorship: Mentor senior and mid-level DevOps engineers.
- Security-First Culture: Build and run the enablement layer - internal documentation, secure-by-default templates, and training.
- Continuous Improvement: Track emerging threats, vulnerabilities, and industry practice.