DevSecOps Engineer - #1751

Jobster Private Ltd; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Jobster Private Ltd is seeking DevSecOps Engineers to design, build, and operate secure, cloud-native infrastructure on AWS for a Singapore public sector project. The role blends infrastructure engineering, cloud security, and secure software delivery across the development lifecycle.

Responsibilities include setting up containerised AWS infra with Terraform, implementing security controls, integrating security scans into GitLab CI/CD, and maintaining observability with Dynatrace or Datadog.

Qualifications

• 3–5 years hands‑on DevOps, cloud infra, or DevSecOps experience for Consultant level.
• 7+ years for Senior Consultant, including 2–3 years defining secure cloud architecture or leading DevSecOps implementation.
• Experience with Singapore Government or public sector security/compliance is a plus.

Responsibilities

• Design, build and operate secure, cloud-native infrastructure on AWS across dev, staging, production.
• Implement least-privilege IAM, network isolation, and container hardening.
• Integrate SAST, dependency, secret, container image and IaC scanning into GitLab CI/CD with gates.
• Set up monitoring and observability using Dynatrace or Datadog.
• Support production deployments and incident response; maintain runbooks.
• Define backup/restore procedures and govern secure infrastructure standards.

Skills

AWS

Terraform

Docker

Kubernetes (EKS)

CI/CD

Security practices

Security scanning tools

Observability

Production operations

Tools

GitLab CI/CD

Dynatrace

Datadog

Job description

Role Overview

We are looking for DevSecOps Engineers to design, build, and operate secure, cloud-native, containerised infrastructure on AWS for a Singapore public sector modernisation project. The role combines infrastructure engineering, cloud security, and secure software delivery, embedding security across infrastructure and the development lifecycle.

Key Responsibilities

• Set up modern cloud-native, containerised infrastructure on AWS using Infrastructure as Code (e.g. Terraform), covering VPC networking, EKS/ECS, RDS, and container registry across dev, staging, and production environments.
• Apply cloud security practices and controls, including least-privilege IAM, EKS Pod Identity, network isolation, system and container hardening, mTLS, secrets management, and encryption at rest and in transit.
• Build security into the development process by integrating SAST, dependency, secret, container image, and IaC scanning into GitLab CI/CD pipelines, with defined pass/fail gates.
• Set up and maintain monitoring, alerting, and observability using tools such as Dynatrace or Datadog.
• Support production deployments and incident resolution, including writing and maintaining runbooks.
• Design, implement, and regularly test backup and restore procedures.
• Integrate infrastructure with identity and access controls (e.g. ADFS, WOG AD, SAML, OIDC, CAM).

Additional responsibilities for Senior Consultant

• Define the secured infrastructure architecture and security baseline for the platform.
• Set up and govern secure infrastructure standards, guardrails, and practices across the team.
• Provide guidance and mentoring to engineers on secure infrastructure and DevSecOps practices.
• Work with agency security teams on security reviews, compliance requirements, and remediation of findings.

Requirements

• Consultant: 3–5 years of hands‑on DevOps, cloud infrastructure, or DevSecOps experience.
• Senior Consultant: 7+ years of experience, including at least 2–3 years defining secure cloud architecture or leading DevSecOps implementation.
• Experience with Singapore Government or public sector security and compliance requirements is an advantage.

Technical skills (must have)

• AWS: hands‑on experience with setting up AWS cloud infrastructure
• Infrastructure as Code: hands‑on experience with Terraform (or equivalent)
• Containers: hands‑on experience with Docker, Kubernetes (EKS)
• CI/CD: hands‑on experience in setting up CI/CD
• Security: hands‑on experience with application and infra security practices
• Security scanning tools: hands‑on experience with security scanning tools
• Observability: hands‑on experience with at least one observability tool
• Operations: hands‑on experience in production operations

Technical skills (good to have)

• Familiarity with observability tools such as Dynatrace, Datadog
• Familiarity with building, containerising, and deploying applications in Golang, Kotlin, and Next.js/TypeScript, and with operating a workflow engine such as Temporal on Kubernetes
• Identity: ADFS, WOG AD, SAML, OIDC, CAM (GovTech Central Accounts Management)
• Trend Micro FAM and other infrastructure/container security tooling
• OutSystems, Oracle Policy Automation (OPA) / Oracle Intelligent Advisor (OIA), Sitefinity, Oracle

Soft skills

• Security-first mindset with a practical, delivery-focused approach.
• Clear documentation and communication skills.
• Senior Consultant: ability to influence engineering teams and explain security trade-offs to stakeholders.