DevSecOps Engineer

NestAI; Tampere; On-site; EUR 85,000 - 120,000; Full time

Benefits offered by this job

Healthcare (Mehiläinen)

Flex benefits

Lunch benefit

Mental wellbeing services

Team events

Mac or PC equipment

Holiday allowance

Phone benefit

Job summary

NestAI is an European AI lab for defence delivering an adaptive operating system for modern battlefield operations. We hire a Senior DevSecOps Engineer to fortify our NestOS platform, automating secure, scalable deployments across cloud, hybrid, and on‑prem environments.

You’ll integrate security into daily engineering, build IAM/OIDC controls, and lead SBOM and software‑supply chain best practices with a strong emphasis on zero-trust principles.

Qualifications

• Hands-on experience with cloud platforms (AWS/Azure/GCP).
• Proven track record designing CI/CD pipelines with security tooling integrated.
• Solid foundation in secrets management, IAM, OIDC.
• Experience with air-gapped, hybrid/on-premise deployments and software supply chain security.

Responsibilities

• Design, build, and maintain scalable cloud environments (AWS, Azure, or GCP) using Terraform and IaC practices.
• Implement automated security testing (SAST, DAST, SCA, IaC scanning) and robust GitOps workflows in CI/CD pipelines.
• Manage, secure, and optimize container workloads on Kubernetes using Helm, Kustomize, and ArgoCD/Flux.
• Own secrets management, IAM, and OIDC configurations to enforce zero-trust access.
• Bridge development and security teams to minimize friction while improving security.

Skills

Cloud platforms (AWS/Azure/GCP)

Terraform

Docker

Kubernetes

GitOps (ArgoCD/Flux)

CI/CD pipelines (GitHub Actions)

Security tooling (SAST/DAST/SCA)

IAM/OIDC

SBOM / Cosign / SLSA

Python/Go/Bash

Compliance frameworks (SOC2/ISO27001/2

Security in air-gapped/on-prem/offline

English (fluent) + Finnish advantage

Policy-as-code (OPA/Gatekeeper)

Keycloak/Identity administration

Tools

ArgoCD/Flux

Helm

Kustomize

Job description

Company

NestAI is a European AI lab for defence delivering the adaptive operating system for modern battlefield operations. We develop adaptive intelligence for unmanned and command systems: AI that continuously learns from operational data and adapts to changing conditions. NestOS is our open, modular, and interoperable platform that enables this at scale and keeps capability evolution under sovereign European control. Founded in 2025 by Peter Sarlin, whose previous company Silo AI became Europe’s largest AI acquisition, NestAI brings together over 150 engineers and scientists and partners with leading European defence forces and industry.

Role Description

We are looking for a (Senior) DevSecOps Engineer to strengthen our Core Engineering team. In this role, you will focus on building, automating, and securing the foundation of our NestOS platform. You will ensure that our deployment pipelines, container orchestration, and cloud infrastructure maintain the highest security standards without sacrificing delivery velocity.

We are looking for a proactive, self-driven problem solver with an infrastructure-first mindset who naturally integrates security practices into daily engineering operations. Your work directly enables secure deployments across cloud, hybrid, and sovereign on-premise environments.

Day-to-day Responsibilities Include

• Design, build, and maintain scalable cloud environments (AWS, Azure, or GCP) using Terraform and modern IaC practices.
• Implement automated security testing (SAST, DAST, SCA, IaC scanning) and robust GitOps workflows directly into CI/CD pipelines.
• Manage, secure, and optimize containerized workloads operating on Kubernetes using Helm, Kustomize, and ArgoCD or Flux.
• Own secrets management, IAM, and OIDC configurations to enforce strict zero-trust access controls across development and production environments.
• Operate between development and security teams, advocating for security best practices without creating engineering friction.

Qualifications

• Hands-on experience with cloud platforms (AWS/Azure/GCP), IaC (Terraform), Docker, Kubernetes, and GitOps delivery (ArgoCD/Flux, Helm, Kustomize).
• Proven track record designing CI/CD pipelines (GitHub Actions, GitLab CI, Azure DevOps, Jenkins) with integrated security tooling (SAST, DAST, SCA, IaC scanning).
• Solid foundation in secrets management, IAM, OIDC, and experience working with at least one compliance framework (SOC 2, ISO 27001, PCI-DSS, or HIPAA).
• Proficient in Python, Go, or Bash, with a proactive, shift-left mindset and strong communication skills to bridge developer velocity and strict security.
• Experience with air-gapped, hybrid/on-premise, or multi-tenant deployments and software supply chain security (SBOM, Cosign, SLSA/SSDF).
• Professional working proficiency in English. Strong Finnish language skills are considered as an advantage.
• Familiarity with defence/regulatory security standards (STIG, CIS, NIS2), policy-as-code (OPA/Gatekeeper), or Keycloak/identity administration is considered as an advantage.

Why join NestAI

At NestAI, you’ll build meaningful, real-world technology as part of a world-class team of engineers, scientists, and experienced professionals. You’ll work on systems where reliability genuinely matters, contribute to Europe’s security and resilience, and solve problems that demand depth, trust, and craftsmanship.

If you want to build with purpose — and with leading experts in the field — you’ve come to the right place.

Perks & Benefits

• Occupational healthcare (currently provided by Mehiläinen)
• Epassi Flex benefit (sports, culture, commuting, wellbeing)
• Lunch benefit (25% tax-free coverage)
• Auntie (mental wellbeing services)
• Regular team lunches and all-hands events
• Your choice of Mac or PC
• Holiday allowance (50% of holiday salary)
• Phone benefit according to company policy (subscription and device)

We are continuously developing and expanding our benefits as we grow.

Practicalities

Employment is subject to applicable security screening (including SUPO, where required).

NestAI is an equal opportunity employer. We consider all applicants based on their skills, experience, and potential.

We are currently unable to provide visa sponsorship or international relocation support for this position. Candidates must already be based in Finland or in the EU and have a valid work permit for this region at the time of application.