Senior DevSecOps Engineer: Automate Security in CI/CD

TheDriveGroup; Sydney; Hybrid; AUD 148,000 - 221,000; Full time

Job summary

TheDriveGroup is seeking a Senior Cyber Security Analyst to lead a DevSecOps security uplift for a major Australian organisation. You will work with security, engineering and infrastructure teams to strengthen CI/CD controls, manage application security risks and improve governance throughout the software development lifecycle.

Key responsibilities include designing automated security gates, managing vulnerabilities and risk exemptions, and embedding security into development workflows.

Qualifications

• Experience in DevSecOps, application security or cyber security engineering.
• Hands-on experience with CI/CD platforms (GitHub Actions, Jenkins, GitLab or Azure DevOps).
• Experience implementing automated security controls and CI/CD pipeline gates.
• Strong understanding of application vulnerabilities, CVSS and risk management.

Responsibilities

• Design, implement and test automated security gates within CI/CD pipelines.
• Manage security vulnerabilities, risk exemptions and risk acceptance processes.
• Embed security controls into development workflows with engineering teams.
• Manage security assessments, compliance requirements and risk tracking (OneTrust).
• Support security integration across cloud infrastructure and IaC.
• Develop technical documentation and security procedures.

Skills

DevSecOps

App Security

Vulnerability management

Security governance

Communication

CI/CD security

OneTrust

Tools

GitHub Actions

Jenkins

GitLab

Azure DevOps

OneTrust

Job description

TheDriveGroup is seeking a Senior Cyber Security Analyst to lead a DevSecOps security uplift for a major Australian organisation. You will work with security, engineering and infrastructure teams to strengthen CI/CD controls, manage application security risks and improve governance throughout the software development lifecycle.

Key responsibilities include designing automated security gates, managing vulnerabilities and risk exemptions, and embedding security into development workflows.