DevSecOps & Security Architect

ECS Resource Group Ltd; Greater London; On-site; GBP 2,399,000 - 2,878,000; Full time

Job summary

ECS Resource Group Ltd. is seeking an experienced DevSecOps & Governance Architect for a major technology transformation programme.

The role focuses on bridging security, governance and engineering to translate policy into practical, reusable patterns with minimal impact on developer productivity. The position requires strong enterprise DevSecOps and platform architecture expertise, including SCA, SBOMs, secrets management and identity controls, with a remote delivery model and a 5-month

Qualifications

• Extensive experience across CI/CD, artefact repositories, containers, runtime provisioning and enterprise integrations.
• Strong understanding of software supply-chain security, including SCA, vulnerability scanning, SBOMs, secrets management and software signing/provenance.
• Experience with Identity, SSO, RBAC, logging and auditable security controls.
• Knowledge of Policy-as-Code and automated security enforcement.
• Understanding of DSPT/CAF-style assurance, governance and security requirements.
• Proven ability to translate risk and policy into practical engineering solutions.
• Excellent architecture workshop, stakeholder management and decision-facilitation skills.
• Able to balance security, governance and developer experience/productivity.

Responsibilities

• Define target and transitional DevSecOps platform architectures.
• Design secure software supply-chain capabilities including SCA, vulnerability scanning, secrets detection, licence controls, SBOMs, signing and provenance.
• Assess and recommend vendor solutions, technologies and deployment options.
• Establish approved, controlled and unsupported usage patterns.
• Design governance, exception handling and risk-acceptance mechanisms.
• Ensure platforms and solutions align with enterprise architecture, security and regulatory obligations.
• Create reusable reference architectures and patterns that can scale across multiple domains.
• Improve platform reliability, build success, performance and supportability.
• Work closely with security, architecture, engineering, delivery and business stakeholders.

Skills

DevSecOps

Platform architecture

CI/CD

SBOMs

Vulnerability scanning

Secrets management

Policy-as-Code

Identity management

Stakeholder management

Decision facilitation

Job description

DevSecOps & Security Architect

Rate: £650 (Inside IR35)

Location: 5 months

Location: Fully Remote

Role Profile

We're looking for an experienced DevSecOps & Governance Architect to join a major technology transformation programme, helping define secure, scalable and governed DevSecOps platforms across the enterprise.

This is an architecture-focused role, requiring someone who can bridge security, governance and engineering - translating policy and risk requirements into practical, reusable technical patterns without unnecessarily impacting developer productivity.

Key Responsibilities

• Define target and transitional DevSecOps platform architectures.
• Design secure software supply-chain capabilities including SCA, vulnerability scanning, secrets detection, licence controls, SBOMs, signing and provenance.
• Assess and recommend vendor solutions, technologies and deployment options.
• Establish approved, controlled and unsupported usage patterns.
• Design governance, exception handling and risk-acceptance mechanisms.
• Ensure platforms and solutions align with enterprise architecture, security and regulatory obligations.
• Create reusable reference architectures and patterns that can scale across multiple domains.
• Improve platform reliability, build success, performance and supportability.
• Work closely with security, architecture, engineering, delivery and business stakeholders.

Essential Experience

• Strong background in Enterprise DevSecOps and platform architecture.
• Extensive experience across CI/CD, artefact repositories, containers, runtime provisioning and enterprise integrations.
• Strong understanding of software supply-chain security, including SCA, vulnerability scanning, SBOMs, secrets management and software signing/provenance.
• Experience with Identity, SSO, RBAC, logging and auditable security controls.
• Knowledge of Policy-as-Code and automated security enforcement.
• Understanding of DSPT/CAF-style assurance, governance and security requirements.
• Proven ability to translate risk and policy into practical engineering solutions.
• Excellent architecture workshop, stakeholder management and decision-facilitation skills.
• Able to balance security, governance and developer experience/productivity.