DevSecOps Engineer

Ocean Infinity; City Of London; On-site; GBP 81,000 - 99,000; Full time

Job summary

Ocean Infinity is recruiting a DevSecOps Engineer to join the Cyber Security team. You will own the Secure Development Life Cycle, integrate security controls into pipelines, and collaborate with developers to accelerate secure software delivery for vessels and autonomy systems.

The role covers threat modelling, secrets management, AI/ML pipeline security, and secure cloud configurations in Microsoft Azure, with travel up to 25% for audits and assurance work.

Qualifications

• Secure SDLC ownership and implementation across pipelines.
• Experience with code analysis and dependency scanning.
• Familiar with Microsoft Azure and cloud security configurations.
• Threat modelling experience and remediation planning.
• Ability to communicate security guidance to engineers and leaders.
• Willingness to travel up to 25%.

Responsibilities

• Define and maintain Secure Development Life Cycle across Ocean Infinity software suites.
• Build security into development and release pipelines with automated code analysis and testing.
• Own secrets management and enforce no credentials-in-code policy.
• Perform threat modelling on new/changed systems and translate findings into fixes.
• Secure AI/ML development pipelines, including model provenance and data lineage.
• Support secure configuration of Azure-based build, deployment and cloud environments.
• Define and maintain software testing procedures and manage supplier firmware/software uploads.
• Produce software assurance evidence for certifications and audits.
• Own and run vulnerability disclosure program and coordinate with external auditors.

Skills

Secure SDLC

DevSecOps pipelines

Code analysis

Dependency scanning

Azure security

Threat modelling

Communication

Autonomous systems security

Travel availability

Education

Security certification (CSSLP/CISSP)

Azure security certification

Tools

Azure DevOps

SonarQube

Snyk

Job description

Worker Type: Employee

Application End Date: 18-09-2026

We are using and creating technology to transform operations at sea to enable people and the planet to thrive.

We are open-minded and fearless in our approach to innovation and don't believe in boundaries. We challenge everything and have massive ambitions to drag aging industries into the tech era.

We take safety, equality and education very seriously, and our responsibilities don't stop at our front door. Our business is built on the belief that there's definitely a more environmentally responsible way to operate at sea.

We employ people who share our core values. We expect our people to be courageous, trustworthy, and conscientious, driven by a desire to do the right thing. We strive for excellence, work collaboratively, and are genuinely excited by our work.

We offer opportunities for our people to develop beyond their role and span a multitude of disciplines. These are open to all, regardless of background and experience level. Working with us means being part of a team that is harnessing technology and creativity to disrupt a traditional industry.

We are not your average workplace.

Ocean Infinity is seeking a DevSecOps Engineer.

Ocean Infinity is building software that runs on vessels and autonomous systems at sea, and the data pipelines behind our survey work. As DevSecOps Engineer you will sit in the Cyber Security team, working day to day alongside our developers, to help the Technology organisation ship software faster and more defensibly. You will own our Secure Development Life Cycle as a living, practical discipline, applying controls in proportion to risk so that security speeds delivery up rather than becoming a check at the end.

You will own security on the build side, including software that will later run on our vessels and autonomous systems. Security of those systems once they are in operation sits with our OT/Marine Cyber Security Engineer, and the two of you will work as a build-to-run pair. The role suits a range of experience, from a recent graduate with solid secure development fundamentals through to an established practitioner, and it combines hands-on technical work with structured development and mentoring.

What you will do

• Own and maintain our Secure Development Life Cycle, defining the security checks that sit inside development workflows across all of Ocean Infinity's software, from enterprise and Technology applications to vessel-bound autonomy and payload software and Data Services pipelines.
• Build security into our development and release pipelines, including automated code analysis, dynamic testing and dependency checking, so that weaknesses are found early rather than at release.
• Own secrets management across development pipelines and enforce a no-credentials-in-code standard.
• Run threat modelling on new and changed systems, and turn what you find into prioritised, proportionate fixes that developers will act on.
• Secure our artificial intelligence and machine learning development pipeline, covering model provenance, training-data lineage and the safe delivery of autonomy and analytics models, and set the ground rules for use of artificial intelligence tools in development.
• Support secure configuration of build, deployment and cloud-hosted development environments, primarily in Microsoft Azure.
• Define and maintain procedures for software testing and for managing supplier firmware and software uploads.
• Produce the software assurance evidence that supports our certifications, client due diligence and, for defence-related work, UK Ministry of Defence supply chain requirements.
• Own and run our vulnerability disclosure programme, and work with external auditors, consultants and suppliers to strengthen software supply chain security.
• Write clear security guidance for developers, and brief leadership, auditors and clients concisely.

Who you are

• Grounded in secure software development, whether you are a recent graduate with solid fundamentals or an established application security practitioner.
• Comfortable working inside modern development pipelines and version control, and able to automate security testing within them.
• Experienced with code analysis and dependency scanning tooling, and able to tell real risk apart from noise.
• Familiar with cloud environments, ideally Microsoft Azure, and how to configure and monitor them securely.
• Practised at threat modelling, and able to translate the output into remediation that development teams will pick up.
• Confident applying controls in proportion to risk, and comfortable explaining that judgement to both engineers and senior leaders.
• An excellent communicator, able to write guidance developers will actually use.
• A critical thinker and able to show initiative.
• Driven, proactive and able to work autonomously with little supervision, towards the company's purpose.
• Open and receptive to new and different ideas.
• Fun/professional/curious.
• Willing to travel up to 25% of the time, both in the UK and internationally, to support security audits and assurance work across our business units.

Desirable

• A recognised security or cloud certification, for example CSSLP, CISSP or a Microsoft Azure security certification.
• Experience of ISO/IEC 27001 or UK Ministry of Defence supply chain security requirements.
• Exposure to operational technology, robotics, maritime or other safety-critical software.
• Experience securing machine learning pipelines, or setting governance for use of large language model tools in development.
• Awareness of data protection and product security regulation, such as GDPR and the EU Cyber Resilience Act.
• Experience of mentoring or guiding less experienced engineers.

Salary for this position: Up to £90,000

Salary: The salary varies for this position as we are recruiting in multiple regional locations and job grades. The salary process is based on skills, abilities, and experience required.

What you can expect:

At Ocean Infinity, we believe in creating equal opportunities for all, celebrating each and everyone's differences. We are driven by transforming the industry, through our technology, thoughts, behaviours and actions. Being inclusive and respectful to all is fundamental to who we are. It is the right thing to do and enables innovation and creativity to thrive.

There is more work to be done, and we know that we aren't perfect, but our commitment to these values is unwavering. They are central to our mission and the impact we have on the industry, meaning, we cannot live without them.