Lead DevSecOps Engineer

Mckesson Corporation; Cork; On-site; EUR 83,000 - 138,000; Full time

Benefits offered by this job

Total Rewards benefits

Job summary

McKesson is seeking a senior cybersecurity engineering leader to drive enterprise security across cloud, on-prem, and hybrid environments. You will design scalable controls for CI/CD pipelines, lead supply‑chain security programs, and mentor engineers to embed secure‑by‑design practices across applications, APIs, containers, and cloud workloads.

The role requires 10+ years in cybersecurity engineering, strong tooling experience, and hands-on cloud and container security.

Qualifications

• 10+ years in cybersecurity engineering or related security roles.
• Bachelor's degree in CS, cybersecurity, or IT (equivalent experience).
• Experience operating enterprise security tools (GitHub Advanced Security, SonarQube, OWASP ZAP).
• Experience with software supply chain security and OSS risk tools (JFrog Xray, Black Duck, Sonatype, FOSSA).
• Proficient in scripting using Python, Bash, or JavaScript.
• Experience designing secure CI/CD pipelines with major platforms.
• Hands-on in cloud security (AWS/Azure/GCP) and container tech (Docker, Kubernetes).
• Experience managing code hosts and developer ecosystems.

Responsibilities

• Lead enterprise security and DevSecOps initiatives across clouds and on‑prem.
• Design scalable security controls in CI/CD and developer platforms.
• Drive adoption of security tools like GitHub Advanced Security, OWASP ZAP, Veracode, SonarQube.
• Lead software supply chain security programs with Xray, Black Duck, Sonatype, FOSSA.
• Develop automation and security integrations using scripting languages.
• Partner with teams to enforce secure‑by‑design for apps, APIs, containers, and cloud workloads.
• Provide leadership during incidents, vulnerability management, and remediation.
• Mentor engineers and shape security architecture and roadmaps.
• Develop security standards for Kubernetes, IaC (Terraform), and cloud apps.
• Build and operate security automation and policy‑as‑code to reduce risk.

Skills

Security leadership

DevSecOps

CI/CD security

Cloud security

Scripting (Python/Bash/JS)

Incident response

Mentoring engineers

Threat modeling

Zero-trust concepts

Policy-as-code

Education

Bachelor's degree in Computer Science or related field

Master's degree (preferred)

Tools

GitHub Advanced Security

SonarQube

OWASP ZAP

JFrog Xray/Curation

Black Duck

Sonatype

FOSSA

Job description

McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve – we care.

What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow’s health today, we want to hear from you.

What You’ll Do

• Lead enterprise application security and DevSecOps initiatives across cloud, on‑premises, and hybrid environments.
• Design and implement scalable security controls embedded within CI/CD pipelines and developer platforms.
• Drive adoption and operationalization of security tools including GitHub Advanced Security, OWASP ZAP, Veracode, and SonarQube.
• Lead software supply chain security programs using tools such as JFrog Xray/Curation, Black Duck, Sonatype, and FOSSA.
• Develop automation and security integrations using Python, Bash, JavaScript, or similar scripting languages.
• Partner with engineering and platform teams to establish secure‑by‑design practices for applications, APIs, containers, and cloud workloads.
• Provide technical leadership during security incidents, vulnerability management efforts, and remediation activities.
• Mentor engineers and influence enterprise security architecture, standards, and roadmaps.
• Develop and maintain security standards and controls for Kubernetes, containers, Infrastructure as Code (Terraform), and cloud‑native application platforms.
• Build and operationalize security automation, policy‑as‑code, and self‑service security capabilities that improve developer experience while reducing organizational risk.

Basic Requirements

• 10+ years of progressive experience in cybersecurity engineering, application security, DevSecOps, cloud security, or related security engineering disciplines.
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, or equivalent experience.
• Experience implementing and operating enterprise‑scale security tools such as GitHub Advanced Security, SonarQube, and/or OWASP ZAP.
• Experience with software supply chain security and open‑source risk management tools such as JFrog Xray/Curation, Black Duck, Sonatype, or FOSSA.
• Proficiency in scripting and automation using Python, Bash, JavaScript, or similar languages.
• Experience designing and securing CI/CD pipelines using GitHub Actions, Jenkins, GitLab CI, Azure DevOps, or comparable platforms.
• Hands‑on experience securing cloud environments (AWS, Azure, and/or GCP).
• Experience with containerization and orchestration technologies including Docker and Kubernetes.
• Experience managing enterprise source code management platforms such as Github or Gitlab, developer ecosystems, and software delivery infrastructure.

Preferred Skills/Experience

• Master's degree in Cybersecurity, Computer Science, or related field.
• Experience implementing policy‑as‑code, infrastructure‑as‑code security, and automated security guardrails.
• Experience with threat modeling, secure code reviews, and application security testing methodologies.
• Knowledge of zero‑trust architectures, identity security, cryptography, and cloud‑native security controls.
• Experience building security metrics, dashboards, and executive‑level reporting.
• Relevant certifications such as CISSP, CCSP, CSSLP, AWS Security Specialty, Azure Security Engineer, or GIAC certifications.
• Experience leading large‑scale security transformation initiatives in highly regulated environments.
• Experience mentoring engineers and serving as a technical leader across multiple teams.
• Experience securing and managing Kubernetes platforms, container registries, and cloud‑native application environments.
• Experience implementing software supply chain security controls including artifact signing, SBOM management, provenance, dependency governance, and secure build practices.

At McKesson, we care about the well‑being of the patients and communities we serve, and that starts with caring for our people. That’s why we have a Total Rewards package that includes comprehensive benefits to support physical, mental, and financial well‑being. Our Total Rewards offerings serve the different needs of our diverse employee population and ensure they are the healthiest versions of themselves.

As part of Total Rewards, we are proud to offer a competitive compensation package at McKesson. This is determined by several factors, including performance, experience and skills, equity, regular job market evaluations, and geographical markets. The pay range shown below is aligned with McKesson's pay philosophy, and pay will always be compliant with any applicable regulations. In addition to base pay, other compensation, such as an annual bonus or long‑term incentive opportunities may be offered.

Our Base Pay Range for this position

€82,500 - €137,500