Senior DevSecOps Engineer – Kubernetes & Software Supply Chain Security

Twoday; København; On-site; DKK 900,000 - 1,500,000; Full time

Job summary

Twoday, a leading digital transformation partner in Northern Europe, is seeking a hands-on Senior DevSecOps Engineer to strengthen security across development pipelines, Kubernetes platforms and production environments for one of our major public-sector clients in Copenhagen. This is a permanent role requiring onsite work in Copenhagen.

You will implement automated security controls across CI/CD pipelines, secure the software supply chain, and collaborate with an experienced operations team to

Qualifications

• Hands-on DevSecOps experience implementing security controls in real development and production environments.
• Experience with software supply chain security: SBOM, artefact signing, and verification.
• Experience with CI/CD automation tools (GitLab CI or GitHub Actions) and scripting.
• Kubernetes security expertise including admission control and policy-as-code.
• Familiarity with vulnerability management, incident response, and log/SIEM tooling.
• Experience with GDPR, ISO 27001/27002 and NIS2 is a plus.

Responsibilities

• Implement automated security controls across CI/CD pipelines and IaC scanning.
• Secure software supply chain with SBOM and artifacts signing.
• Enforce least-privilege across pipelines, runners, and environments.
• Apply Kubernetes security controls and secret management.
• Harden Linux/Windows and manage vulnerabilities end-to-end.
• Support runtime threat detection, incident response and forensics.
• Document controls for compliance and audit; transfer knowledge to team.

Skills

DevSecOps

CI/CD automation

Kubernetes security

Security controls implementation

Vulnerability management

Incident response

GDPR compliance

Danish & English fluency

Tools

GitLab CI

GitHub Actions

Terraform

Ansible

Python

Bash

PowerShell

Kyverno

OPA Gatekeeper

Vault

Sigstore/Cosign

Falco

Proxmox

Job description

Twoday is the leading digital transformation partner in Northern Europe with a global presence. With approximately 3,000 technologies, we collaborate with the most admired private and public organizations to deliver cutting-edge digital solutions. Our deep industry expertise spans Data & AI, software development, digital experiences, and business applications. Operating across the Nordics and Lithuania, our team generated a revenue of 280 million euros in 2023. We serve over 8,000 customers, supporting their digital transformation journeys.

Senior DevSecOps Engineer – Kubernetes & Software Supply Chain Security

Permanent position at Twoday | Copenhagen

Twoday is a leading digital transformation partner in Northern Europe, with approximately 3,000 specialists delivering digital solutions to public and private organisations.

We are looking for an experienced, hands-on DevSecOps Engineer to strengthen security across development pipelines, Kubernetes platforms and production environments for one of our major public-sector clients.

This is a role for someone who implements, automates and maintains security controls – not someone who only advises on them.

Your role

You will work alongside an experienced operations team, embedding security into development, deployment and daily operations while helping the team adopt secure, sustainable engineering practices.

• Implementing automated security controls across CI/CD pipelines, including SAST, SCA, secret scanning, container scanning and Infrastructure as Code (IaC) scanning.
• Securing the software supply chain through SBOM generation (CycloneDX/SPDX), artefact signing and verification (e.g. Sigstore/cosign), SLSA principles and secure branch, review and release processes.
• Securing CI/CD pipelines and runners using least-privilege principles.
• Implementing Kubernetes security controls, including admission control, policy-as-code, Pod Security Standards, RBAC, network policies and secrets management.
• Hardening Linux and Windows environments and managing vulnerabilities from identification through to remediation.
• Supporting runtime threat detection, security monitoring, incident response and forensic investigations.
• Establishing security frameworks for AI-assisted development and autonomous AI agents, including controlled permissions, review gates, traceability and protection against prompt injection.
• Documenting security controls for compliance and audit purposes, while sharing knowledge and transferring solutions to the internal team.

What we’re looking for

You have practical DevSecOps experience and can demonstrate that you have implemented security controls in real development and production environments.

We are particularly interested in experience with:

• Software supply chain security: SAST, SCA, secret scanning, SBOM, artefact signing and verification, container and IaC scanning.
• CI/CD and automation: GitLab CI, GitHub Actions or similar, secure pipelines and runners, Terraform, Ansible and scripting with Python, Bash or PowerShell.
• Kubernetes security: Kyverno, OPA Gatekeeper or similar, admission control, Pod Security Standards, RBAC, network policies and secrets management using Vault, External Secrets or equivalent.
• Platform security: CIS-based Linux hardening, Windows Server hardening and runtime detection tools such as Falco.
• Vulnerability management and incident response: Risk-based remediation, logging, SIEM solutions such as ELK or Wazuh, incident handling and forensics.
• AI security: Security controls for AI-assisted and agentic workflows, including autonomy boundaries, human review, prompt injection protection and secure credential handling.
• Compliance: NIS2, ISO 27001/27002 and GDPR.

Experience with virtualisation platforms such as Proxmox is useful. Experience from the public sector or organisations subject to NIS2 is an advantage, but not essential.

The environment follows an open-source-first approach with EU-based infrastructure. Experience with US hyperscalers is not relevant to this assignment.

You must be fluent in Danish and English, both written and spoken, and able to work onsite full time in Copenhagen.

Who You Are

You are hands-on, security-conscious and pragmatic. You see security as an enabler rather than an obstacle, prioritise risks sensibly and enjoy helping experienced engineers strengthen their security practices. You take ownership, document your work and build solutions that others can maintain.

Why Twoday?

At Twoday, you will work with skilled colleagues on complex, business-critical solutions that make a real difference. We offer a collaborative environment with professional freedom, technical challenges and opportunities to develop your expertise.

Diversity & inclusion

Do you not meet all the requirements? Studies show that women and minorities are less likely to apply if they don’t meet every qualification. At Twoday, we are committed to building an inclusive workplace where everyone is welcome.