DevSecOps Engineer

AJENTIK AI PTE. LTD.; Singapore; On-site; SGD 90,000 - 150,000; Full time

Benefits offered by this job

Equity participation

Security ownership

ISO training

Small team

Health benefits

Training budget

Career growth

Job summary

Ajentik AI Pte. Ltd. is hiring a DevSecOps Engineer to own how Elderwise is built, shipped and run securely in Singapore.

You will ensure secure delivery by integrating SAST, secret scanning, SBOMs and signed artefacts into GitHub Actions and Argo CD-based pipelines. You will collaborate with platform engineers and founders across cloud, partner-hosted and on-premise environments, managing infrastructure-as-code, Kubernetes hardening, incident response, and data protection to support ISO

Qualifications

• 3+ years in DevOps, platform, SRE or security engineering, with 2+ years running Kubernetes
• Infrastructure as code with Terraform or OpenTofu: module design, remote state and safe change workflows
• Hands-on CI/CD and GitOps experience, with security tooling integrated into pipelines
• Strong AWS fundamentals (IAM, networking, KMS, storage); exposure to Azure or other clouds is useful
• Solid Linux, networking, TLS and DNS knowledge
• Scripting in Python, Bash or Go
• Experience working inside a security or compliance scope such as ISO 27001 or SOC 2
• A calm, methodical approach to incidents, and documentation good enough for someone else to follow

Responsibilities

• Own CI/CD for our backend, web and mobile apps (GitHub Actions, with GitOps through Argo CD), with security gates built in
• Build and maintain infrastructure as code with OpenTofu across a hybrid-cloud footprint, with no manual changes in production
• Harden and operate Kubernetes: default-deny network policies, workload identity, admission controls, upgrades and capacity planning
• Run secrets, identity and access on least privilege, including key rotation, periodic access reviews and secure handling of model and API credentials
• Own observability, alerting and incident response: logs, metrics, traces, on-call runbooks and blameless post-incident reviews
• Protect data end to end: encryption at rest and in transit, Singapore data residency, tested backups and disaster-recovery drills
• Secure our AI systems with the AI team: model gateway controls, egress restrictions, prompt-injection defences, and logs that support debugging without exposing personal data
• Implement and evidence ISO 27001 controls in our compliance platform (Drata), and support our ISO 42001, PDPA and customer audit work
• Package Elderwise for deployment into hospital and partner environments, including private cloud and on-premise, and support customer security reviews, VAPT and network documentation
• Run vulnerability management and coordinate penetration tests, tracking every finding to closure
• Treat cloud cost as an engineering metric and keep it under control

Skills

CI/CD

GitOps

Kubernetes

Terraform

OpenTofu

Python

Bash

Go

AWS

Security

Tools

GitHub Actions

Argo CD

OpenTofu

Terraform

TLS/DNS

KMS

Vulnerability scanning

Job description

About Ajentik

Ajentik AI Pte. Ltd. is a Singapore healthtech company incubated at NUSX (formerly NUS Enterprise). We build Elderwise, an AI-powered Comprehensive Geriatric Assessment (CGA) platform that turns caregiver observations into structured, EMR-ready clinical summaries. Caregivers speak with our voice assistant in the browser, with no app to install. Clinicians receive a structured summary to review and file, and families receive a plain-language report. We are in pilot discussions with geriatric teams across Singapore's public healthcare clusters and the community care sector.

About the Role

As our DevSecOps Engineer, you will own how Elderwise is built, shipped and run securely. You will make secure delivery the default: every change goes through Git, every pipeline has security gates, and every control leaves evidence that an auditor or a hospital security team can check.

We handle health and personal data, and our customers include public hospitals that run their own security reviews before anything goes live. This role sits at the centre of that trust. You will work with our platform engineers and the founders across cloud, partner-hosted and on-premise environments, and you will be the person our customers' IT and security teams speak to about infrastructure.

Key Responsibilities

• Own CI/CD for our backend, web and mobile apps (GitHub Actions, with GitOps through Argo CD), with security gates built in: SAST, dependency and secret scanning, container image scanning, SBOMs and signed artefacts
• Build and maintain infrastructure as code with OpenTofu across a hybrid-cloud footprint, with no manual changes in production
• Harden and operate Kubernetes: default-deny network policies, workload identity, admission controls, upgrades and capacity planning
• Run secrets, identity and access on least privilege, including key rotation, periodic access reviews and secure handling of model and API credentials
• Own observability, alerting and incident response: logs, metrics, traces, on-call runbooks and blameless post-incident reviews
• Protect data end to end: encryption at rest and in transit, Singapore data residency, tested backups and disaster-recovery drills
• Secure our AI systems with the AI team: model gateway controls, egress restrictions, prompt-injection defences, and logs that support debugging without exposing personal data
• Implement and evidence ISO 27001 controls in our compliance platform (Drata), and support our ISO 42001, PDPA and customer audit work
• Package Elderwise for deployment into hospital and partner environments, including private cloud and on-premise, and support customer security reviews, VAPT and network documentation
• Run vulnerability management and coordinate penetration tests, tracking every finding to closure
• Treat cloud cost as an engineering metric and keep it under control

Requirements

• At least 3 years in DevOps, platform, SRE or security engineering, including 2 or more years running Kubernetes in production
• Infrastructure as code with Terraform or OpenTofu: module design, remote state and safe change workflows
• Hands-on CI/CD and GitOps experience, with security tooling integrated into pipelines
• Strong AWS fundamentals (IAM, networking, KMS, storage); exposure to Azure or other clouds is useful
• Solid Linux, networking, TLS and DNS knowledge
• Scripting in Python, Bash or Go
• Experience working inside a security or compliance scope such as ISO 27001 or SOC 2: change management, audit evidence, access reviews and asset inventory
• A calm, methodical approach to incidents, and documentation good enough for someone else to follow

Nice to Have

• Certifications such as CKA, CKS or AWS Certified Security Specialty
• Secrets management with Vault or OpenBao, and policy as code with OPA or Kyverno
• eBPF-based networking and security, for example Cilium
• Experience with healthcare or other regulated data, hospital IT security reviews, or Singapore requirements such as PDPA and MOH and CSA guidance
• Familiarity with LLM application security, such as the OWASP Top 10 for LLM Applications
• Mobile release pipelines, including iOS and Android code signing in CI
• Self-hosted model serving or GPU workloads on Kubernetes

What We Offer

• Competitive salary with equity participation
• Ownership of security and platform from day one, in a company where security is a selling point rather than an afterthought
• Hands-on involvement in our ISO 27001 and ISO 42001 programmes
• A small, senior team of engineers, clinicians and founders
• Health benefits and flexible work arrangements
• Training and certification budget
• A clear path toward leading the platform and security function as the engineering team grows

Your Impact

Hospitals adopt new technology only when they trust it. The controls you build and the evidence you keep are what let clinicians use Elderwise with confidence, and what let older adults and their families share sensitive information safely.

Ajentik is an equal opportunity employer. We welcome applicants of all backgrounds and assess every candidate on merit.