Azure DevSecOps Engineer: Secure, Scalable Cloud

NCS Pte Ltd; Singapore; On-site; SGD 120,000 - 160,000; Full time

Job summary

NCS Pte Ltd is seeking a DevSecOps Engineer to own the security, reliability, and delivery of its Azure platform and Kubernetes workloads. You will automate secure-by-default infrastructure, enable fast code shipping without compromising security, and partner with product teams to ship safely.

Responsibilities cover Azure Landing Zones, AKS security, GitHub Actions/Azure DevOps pipelines, SBOM and cosign, Ingress/egress controls, and incident response through Azure Monitor and Sentinel.

Qualifications

• 7+ years in DevOps/SRE/Platform Engineering with 3+ years on Azure and 2+ years operating Kubernetes in production.
• Proven delivery of Azure Landing Zones or equivalent enterprise Azure foundations, expressed as Terraform or Bicep modules.
• Strong with GitHub Actions/Azure DevOps, artifacts, environments, approvals, reusable workflows.
• Hands-on with container runtime security & policy: OPA/Gatekeeper or Kyverno, Pod Security restricted, read-only root FS, capability drops, seccomp/AppArmor.

Responsibilities

• Platform engineering (Azure): Build and evolve Azure Landing Zones and policy-as-code guardrails.
• Kubernetes (AKS): Design and operate private AKS clusters, implement security standards and network policies.
• CI/CD & supply chain: Standardize pipelines with SBOM, image scanning, cosign signing/verification, provenance and GitOps with Argo CD/Flux.
• Identity & secrets: Implement Entra ID RBAC & PIM, Managed Identities, Key Vault/Secrets Store CSI, secret rotation.
• Observability & IR: Establish Azure Monitor/Log Analytics baselines, tracing, SLOs, alerts; integrate with Sentinel; lead incident response.
• Cloud security posture: Defender for Cloud, vulnerability management, automated remediation.
• Networking & data protection: Private Link/Endpoints, DNS, encryption at rest/in transit, KMS.
• Resilience & DR: Backups, multi-region patterns, chaos experiments, DR runbooks.
• FinOps & compliance: Tagging/budgets, right-sizing, CIS/NIST/ISO controls; produce audit evidence.
• Coaching & enablement: Pair with product teams, review designs/PRs, uplift platform literacy.

Skills

Azure

Kubernetes

GitHub Actions

Azure DevOps

SBOM

Cosign

Argo CD

Flux

RBAC

PIM

Security hardening

Tools

Terraform

Bicep

Azure Policy

Nessus

ACR

Job description

NCS Pte Ltd is seeking a DevSecOps Engineer to own the security, reliability, and delivery of its Azure platform and Kubernetes workloads. You will automate secure-by-default infrastructure, enable fast code shipping without compromising security, and partner with product teams to ship safely.

Responsibilities cover Azure Landing Zones, AKS security, GitHub Actions/Azure DevOps pipelines, SBOM and cosign, Ingress/egress controls, and incident response through Azure Monitor and Sentinel.