Azure DevSecOps Engineer - Platform & Security Lead

NCS Group; Singapore; On-site; SGD 180,000 - 280,000; Full time

Job summary

NCS Group in Singapore seeks a seasoned Platform Engineer (Azure) to design, build and run enterprise cloud foundations. You will manage Azure Landing Zones, AKS with policy-based security, CI/CD pipelines, secret management, and observability across deployments.

Bring 7+ years in DevOps/SRE, strong Terraform/Bicep experience, container security, and network hardening skills to deliver resilient, compliant platforms. On-site in Singapore with global collaboration.

Qualifications

• 7+ years in DevOps/SRE/Platform Engineering with 3+ years on Azure and 2+ years operating Kubernetes in production.
• Proven delivery of Azure Landing Zones or equivalent enterprise Azure foundations expressed as Terraform or Bicep modules.
• Strong with GitHub Actions/Azure DevOps, artifacts, environments, approvals, reusable workflows.
• Hands-on with container runtime security & policy: OPA/Gatekeeper or Kyverno, Pod Security restricted, read-only root FS, capability drops, seccomp/AppArmor.
• Network security in K8s: NetworkPolicy default-deny, ingress controllers (Nginx/AGIC), egress control, TLS everywhere, mTLS preferred.
• Image lifecycle: private registries (ACR), pull-through caches, cosign signing & admission verification, Nessus scanning.
• Observability: Azure Monitor/Logs, DCRs, dashboards, SLOs, alert routing to ITSM; experience integrating with Sentinel or enterprise SIEM.
• Infra & config as code at scale; linting/testing/policy gates; change automation and drift detection (GitOps).
• Solid Linux fundamentals, networking, PKI, and incident response.

Responsibilities

• Platform engineering (Azure): Build and evolve Landing Zones, Management Group hierarchy, subscription vending, and policy-as-code guardrails.
• Kubernetes (AKS): Design & operate private AKS clusters, implement Pod Security Standards, network policies, workload identity, and secure ingress/egress.
• CI/CD & Supply Chain: Standardize pipelines in GitHub Actions / Azure DevOps; enforce SBOM, image scanning, cosign signing/verification, provenance and immutable deploys (GitOps with Argo CD/Flux).
• Identity & Secrets: Implement Entra ID RBAC & PIM, Managed Identities, Key Vault / Secrets Store CSI, and secret rotation practices.
• Observability & IR: Establish Azure Monitor / Log Analytics baselines, tracing, SLOs, actionable alerts; integrate with Microsoft Sentinel; lead incident response and postmortems.
• Cloud Security Posture: Drive Defender for Cloud coverage, vulnerability management (containers, hosts, code), and automated remediation.
• Networking & Data Protection: Hub-and-spoke or vWAN, Private Link/Endpoints, Private DNS, Firewall/NAT Gateway egress control; encryption at rest & in transit, KMS integrations.
• Resilience & DR: Backups (RSV/Velero), multi-region patterns, chaos exercises, capacity planning; codify DR runbooks and perform tests.
• FinOps & Compliance: Implement tagging/budgets, right-sizing, Reservations/Savings Plans; map controls to CIS/NIST/ISO and produce audit evidence from pipelines.
• Coaching & Enablement: Pair with product teams, review designs/PRs, write reference modules/templates, and uplift platform literacy across the org.
• Security Hardening: Enable hardening for respective components, including OS, App, and Azure Services hardening.

Skills

Azure Platform

AKS

Terraform/Bicep

GitHub Actions / Azure DevOps

Container Security

Network Security

Observability

GitOps

Secret Management

Security Hardening

Job description

NCS Group in Singapore seeks a seasoned Platform Engineer (Azure) to design, build and run enterprise cloud foundations. You will manage Azure Landing Zones, AKS with policy-based security, CI/CD pipelines, secret management, and observability across deployments.

Bring 7+ years in DevOps/SRE, strong Terraform/Bicep experience, container security, and network hardening skills to deliver resilient, compliant platforms. On-site in Singapore with global collaboration.