DevSecOps Engineer

Bluetree Group; Rotherham; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Health plan

Parental leave

Annual leave

Team events

Pension

Discounts

Cycle to Work

Free parking

Fruit & beverages

Onsite canteen

Job summary

Bluetree Group in the UK is looking for a DevSecOps Engineer to secure cloud infrastructure and CI/CD pipelines across Route 1 Print and Instantprint. You will own remediation of vulnerabilities, implement automated security controls, and collaborate with website, internal systems and IT teams.

The role covers AWS security, CI/CD tooling, IaC security scanning, SAST/SCA tooling, container security, and AI-risk management. Hybrid working and impactful, modern security tooling await.

Qualifications

• Hands-on AWS security experience and ownership of CI/CD security gates.
• Experience with SAST/SCA, secrets scanning, and IaC security scanning.
• Ability to read and fix code in at least one modern language.
• Familiarity with Terraform/CloudFormation/Pulumi and container security.
• Understanding AI-assisted development risks and risk-based prioritisation.

Responsibilities

• Own remediation of security findings across cloud, apps, and infra.
• Introduce automated controls and monitoring to prevent reoccurrence.
• Manage security tooling for SAST, SCA, secrets scanning, and IaC security.
• Secure CI/CD pipelines and guard AI coding tools access.
• Harden AWS: IAM, S3, logging, and threat detection.
• Review infrastructure against CIS benchmarks and implement changes.
• Collaborate with IT to patch and configure internal systems.

Skills

AWS security

CI/CD pipelines

SAST

SCA

Secrets scanning

IaC security

Terraform

CloudFormation

Pulumi

Docker

GitHub Actions

Jenkins

Azure DevOps

CIS benchmarks

Vulnerability management

AI risk awareness

Tools

GitHub Actions

Jenkins

Azure DevOps

Terraform

CloudFormation

Pulumi

Docker

Job description

We're a leading e-commerce print company operating two distinct online brands, Route 1 Print and Instantprint. Our core mission is simple: to make print buying as easy as possible for small businesses.

An opportunity has arisen for a DevSecOps Engineer to join our technology team. You'll be responsible for the security of the cloud infrastructure and development pipelines behind both brands — and for fixing the issues you find.

About the Role

More of our code is now written with AI. That speeds up delivery, but every change still has to be secure — and the volume of change moving through our pipelines makes that impossible to guarantee by hand. This role exists to build security into how we ship, and to keep our cloud infrastructure in good shape.

This is a hands-on engineering role, not an advisory one. You will be responsible for actioning and fixing security findings, not just reporting them. When a scan flags a vulnerable dependency, a misconfigured bucket, or an over-permissive role, you'll take technical ownership of the remediation, delivering fixes directly wherever possible and coordinating with other teams when needed.

You’ll work closely with our website, internal systems, and IT teams, agreeing priorities with them and making the changes yourself wherever you can.

What You'll Do

• Take technical ownership of security findings across our cloud, application, and internal environments: triaging and prioritising them by real risk, delivering fixes directly wherever possible, and coordinating remediation with other teams when needed.
• Fix issues within agreed timescales by severity, and report open findings and how long they've been open to the leadership team each month.
• Where practical, introduce automated controls, tests, or monitoring to prevent resolved security issues from recurring.
• Implement and maintain automated security scanning across our CI/CD pipelines, covering application code, dependencies, containers, and Infrastructure as Code (IaC). Configure and tune the tooling to identify genuine risks without unnecessarily slowing development.
• Set guardrails for AI-written code, including checks on new dependencies and clear limits on what AI coding tools and agents can access.
• Harden the pipelines themselves: branch protection, least-privilege permissions, and short-lived deployment credentials.
• Own the security of our AWS environment — least-privilege IAM, S3 access, logging, and threat detection.
• Review our existing infrastructure on an ongoing basis against recognised benchmarks such as CIS, making the updates and configuration changes required.
• Use automation and Infrastructure as Code wherever practical to implement consistent, repeatable security improvements rather than relying on manual configuration changes.
• Assess and improve the security of application APIs and third-party integrations, addressing authentication, authorisation, and configuration weaknesses.
• Own the output of our vulnerability scanning, working with our IT team to get internal systems patched and configured correctly.

About You

• A background in DevOps, platform, or cloud engineering, now specialising in security. This role needs someone who builds and fixes, not someone who only audits.
• Strong experience (typically 4+ years) across DevOps or cloud engineering, with a significant focus on security.
• Hands-on AWS security experience, including IAM, S3, CloudTrail, GuardDuty, Security Hub, and AWS Config.
• Hands-on ownership of CI/CD pipelines (e.g., GitHub Actions, Jenkins, TeamCity, Azure DevOps), including adding security gates to them.
• Practical experience implementing and managing application security tooling, including static analysis (SAST), software composition analysis (SCA), secrets scanning, and Infrastructure as Code security scanning.
• Comfortable reading and fixing application code in at least one modern language (e.g., C#, Java, Go, or similar).
• Experience with Infrastructure as Code (e.g., Terraform, CloudFormation, Pulumi), and a sharp eye for insecure configurations within it.
• Knowledge of containerisation (e.g., Docker) and how to secure images and container workloads.
• An understanding of the security risks AI-assisted development introduces, and how to manage them without slowing down delivery.
• The judgement to prioritise by real risk, alongside the confidence to take ownership, challenge existing thinking, and see fixes through.
• Security certifications (e.g., AWS Certified Security – Specialty) or experience with Cyber Essentials Plus, ISO 27001, or PCI DSS are beneficial, but not essential.

Why Join Us

• Real ownership: Security across our cloud and delivery pipelines — you set the standards and make the fixes.
• Preventive, engineering-led focus: 24/7 threat monitoring is handled by our managed detection partner, so your time goes into making things more secure.
• Modern tooling: Investment in modern security tooling, with the freedom to shape how security is integrated into our development processes.
• High impact: High-traffic, commercially critical platforms where your work protects the business and our customers.
• Great culture: A culture that values curiosity, experimentation, and continuous learning.
• Work-life balance: Flexible, hybrid working and a small, capable team.

Why Join the Bluetree Team?

At Bluetree Group, we don’t just print; we innovate. We believe in investing in the people who make our success possible. Here’s how we look after you:

• Health First: Access to a market-leading Health Cash Plan and comprehensive wellbeing support, including onsite training and free external support.
• Family Support: Enhanced maternity, paternity, and adoption packages to support your life outside of work.
• Rest & Recharge: 22 days annual leave (plus Bank Holidays), with a "Length of Service" programme that earns you more days the longer you stay.
• Social: From regular team socials to our legendary annual Summer and Christmas Parties, plus biennial Long Service celebrations — we know how to celebrate success.
• Financial Wellness: Enrolment in our company pension scheme.
• Rewards: Access to various discounts via Bluetree Rewards, weekend break giveaways, and long-service gifts to mark your milestones starting from year 1!
• Career Development: We champion personal development with a wide range of internal and external training opportunities available.
• Fitness: Save on a new bike with our Cycle to Work scheme, or join our weekly football team to burn off some steam!
• Daily Comforts: Fuel your day with free fruit, snacks, and beverages in our modern canteen.
• Easy Commute: Free onsite parking at our state-of-the-art facility. We are also ideally located for public transport, just minutes from Mexborough, Swinton, and Wombwell train stations.

About Bluetree Group

We exist to make print buying easy and small businesses look exceptional. Established in 1989, Bluetree Group has grown to be the UK’s largest online printer. Based in Wath upon Dearne (conveniently located near Sheffield, Rotherham, Barnsley, and Doncaster), our 165,000 sq. ft. facility is the heart of our operation. From the moment you walk through our doors, you’ll realise that our people are central to everything we do.

Ready to grow with us?

For Privacy information, please follow this link to our privacy notice on our website homepage: https://www.bluetreegroup.co.uk

#LI-Onsite