Principal DevSecOps Platform Engineer

OutSystems - Software em Rede S.A.; Lisboa; On-site; EUR 120,000 - 180,000; Full time

Job summary

OutSystems is seeking a Principal Platform Engineer in DevSecOps to own the security and integrity of the outer release loop across R&D. You will set direction, balance trade-offs, and partner with engineering, product and security leadership to secure every artifact before production.

You will stay hands-on, architect deploy-time policy and attestation, drive automation, and ensure fast recovery when incidents occur.

Qualifications

• Bachelor's degree in Computer Science, Information Technology or related field.
• You have owned the security and compliance posture of a production platform end to end, at scale and under audit.
• Deep security engineering background: deploy-time policy enforcement, vulnerability management at scale, incident response, supply chain integrity (signing, attestation, SBOM) and continuous compliance automation.
• Hands-on experience with Kubernetes, a major cloud (Azure and/or AWS), CI/CD at scale, Terraform, and modern SDLC languages (Python, .NET).
• Working knowledge of SOC 2 Type 2 and FedRAMP Moderate, including how their controls apply to deployment, operations and platform governance.
• Experience with AST, CWPP or CNAPP tooling integrated into delivery pipelines.
• A track record of cross-team technical leadership and mentoring without formal management authority.
• Availability to participate in an on-call rotation for critical incidents.
• Excellent written and verbal communication, for aligning engineering, product, security and business stakeholders.

Responsibilities

• Own the technical strategy for outer-loop security and supply chain integrity across R&D delivery: set direction, make the trade-off calls, and bring engineering, product and security leadership along.
• Stay hands-on. Design and build what you architect (deploy-time policy, attestation verification, remediation workflows, security automation), own critical paths yourself, and work in the code alongside the team.
• Enforce supply chain integrity at the release boundary: artifact signing and attestation, SBOM and provenance verification, and dependency and third-party risk, so only trusted artifacts reach production.
• Build security controls into the deployment path across environments, so the pipeline stops unsafe changes before a person has to.
• Close the vulnerability loop end to end: detection, prioritization by exploitability, routing, remediation and verification, with critical and high findings fixed on time and automation wherever human judgment adds nothing.
• Lead response to security and operational incidents affecting the delivery platform, drive faster recovery, and own the long-term fixes.
• Automate compliance evidence: turn control requirements into continuous, machine-verified checks instead of audit-season effort.
• Build automated, secure delivery for build and production environments, keeping the platform secure and resilient with every release.
• Lead cross-team technical initiatives that raise engineering standards across the organization, and lead architecture and design reviews at a strategic level.
• Mentor engineers at every level, beyond your immediate team.
• Apply AI and agents to how release and security engineering work gets done.
• Write the standards others build against: deploy-time policy, platform reliability guidelines and security baselines, based on what you have implemented yourself.

Skills

Security mindset

Cross-team leadership

Mentoring

Communication

Policy enforcement

On-call readiness

Hands-on engineering

Education

Bachelor's degree in Computer Science or related field

Tools

Kubernetes

Azure

AWS

CI/CD pipelines

Terraform

Python

.NET

Job description

OutSystems is seeking a Principal Platform Engineer in DevSecOps to own the security and integrity of the outer release loop across R&D. You will set direction, balance trade-offs, and partner with engineering, product and security leadership to secure every artifact before production.

You will stay hands-on, architect deploy-time policy and attestation, drive automation, and ensure fast recovery when incidents occur.