Azure DevSecOps Engineer: Secure Kubernetes & CI/CD

NCS; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

NCS is seeking a DevSecOps Engineer to own the security, reliability, and delivery of our Azure platform and Kubernetes workloads. You’ll be the hands-on engineer for secure-by-default infrastructure—automating everything-as-code and partnering with product teams to ship code quickly without compromising security.

Responsibilities include building Azure Landing Zones, private AKS clusters, SBOM and image scanning, Entra ID RBAC, and Azure Monitor integration.

Qualifications

• 7+ years in DevOps/SRE/Platform Eng with 3+ years on Azure and 2+ years operating Kubernetes in production.
• Proven delivery of Azure Landing Zones or equivalent, expressed as Terraform or Bicep modules.
• Strong with GitHub Actions/Azure DevOps, artifacts, environments, approvals, reusable workflows.
• Hands-on with container runtime security & policy: OPA/Gatekeeper or Kyverno, Pod Security, read-only root FS.
• Network security in K8s: NetworkPolicy deny, ingress controllers, TLS, mTLS preferred.
• Image lifecycle: private registries, cosign signing, and admission verification.
• Observability: Azure Monitor/Logs, dashboards, SLOs, alert routing to SIEM.
• Infra & config as code at scale; GitOps with change automation.
• Solid Linux fundamentals, networking, PKI, and incident response.

Responsibilities

• Own security, reliability, and delivery of the Azure platform and Kubernetes workloads.
• Standardize CI/CD pipelines; enforce SBOM, image scanning, and immutable deploys with GitOps.
• Implement Entra ID RBAC & PIM, Managed Identities, Key Vault & Secrets rotation.
• Establish observability baselines, alerts, and incident response; integrate with SIEM.
• Drive cloud security posture, vulnerability management, and automated remediation.
• Design networking, private endpoints, and data protection with encryption in transit and at rest.
• Codify DR runbooks, backups, and multi-region patterns; perform tests.
• Coach product teams, write reference modules/templates, uplift platform literacy.

Skills

Azure

Kubernetes

GitHub Actions

Azure DevOps

Policy as code

Tools

Argo CD/Flux

Terraform

Nessus/OS hardening tools

AKS security

Job description

NCS is seeking a DevSecOps Engineer to own the security, reliability, and delivery of our Azure platform and Kubernetes workloads. You’ll be the hands-on engineer for secure-by-default infrastructure—automating everything-as-code and partnering with product teams to ship code quickly without compromising security.

Responsibilities include building Azure Landing Zones, private AKS clusters, SBOM and image scanning, Entra ID RBAC, and Azure Monitor integration.