Head of DevSecOps Platform & GitOps

FULLERTON HEALTH PTE. LTD.; Singapore; On-site; SGD 150,000 - 190,000; Full time

Job summary

Fullerton Health Pte. Ltd. seeks a strategic leader to design and operate a secure DevSecOps platform spanning CI/CD, observability, and governance.

You will own secure software supply chains, runtime protection, and robust incident response while driving DR readiness and compliant change management across all environments. The role demands deep expertise in modern SRE practices, GitOps, and policy-as-code, with a focus on scalable, zero-downtime delivery and cross-team influence to push

Responsibilities

• Lead the design, implementation, and maintenance of a comprehensive DevSecOps CI build pipeline with local pre-commit secret detection, SCA for vulnerable dependencies, SAST and quality gates, rootless container builds, immutable image scanning, and automated smoke testing before registry release.
• Enforce a strictly decoupled CI/CD and GitOps delivery architecture to eliminate branch-per-environment drift, promoting immutable image tags across Dev, SIT, UAT and Production using a single-branch config repo and directory overlays, reconciled via GitOps pull requests and controllers.
• Own AppSec lifecycle governance, supply chain security, and post-deployment runtime defenses across environments; generate SBOMs, sign container images (Cosign), integrate DAST with OWASP ZAP, and deploy Falco runtime security cameras on production Kubernetes nodes for real-time detection of suspicious activity.
• Architect and maintain enterprise-grade infrastructure observability, log aggregation, and self-healing patterns; configure active runtime security instrumentation to detect system-call anomalies, establish metric-driven alerting, and deploy Argo CD to automatically correct cluster drift.
• Own reliability, scale, and disaster recovery strategies; define and test deterministic, zero-downtime rollback approaches using automated Git reverts to restore stable states while managing capacity and ensuring high availability across all environments.
• Deliver and operate golden paths that a new service can adopt in under a day, with CI/CD, observability, security gates and deployment wired in by default.
• Implement SDLC as pipeline configuration—branch protection, mandatory review, scanning gates, artifact signing, deployment approvals—so evidence is generated as a build artifact for audits.
• Execute Security Engineering’s policy-as-code in the pipeline without governing security thresholds or acting as a build-failure help desk.
• Drive measurable improvement in DORA metrics across the engineering organisation, establishing a baseline before the modernisation programme scales.
• Establish and own the SLO framework with user-focused SLIs, tiered targets, and enforceable error budgets.
• Own incident management from a reliability perspective—severity definitions, blameless postmortems, and closure of postmortem actions.
• Set humane and sustainable on-call standards: rotation size, page-load ceilings, compensation, and focus on reducing paging causes.
• Run production readiness reviews as gate for tier-1 services entering production, including DR and chaos exercises against contracted RTO/RPO commitments.
• Ensure SRE remains an engineering discipline and not a centralised operations function.
• Ensure segregation of duties via pipeline controls: peer review, deployment credentials, no standing production access, and time-boxed break-glass.
• Produce audit-ready change and access evidence for HIPAA, HITRUST and PDPA as a by-product of normal operation.
• Partner with Security Engineering and Compliance on SDLC standards, control mapping, and exceptions without owning risk acceptance.
• Build and lead an engineering team with rhythms that protect reliability during peak migrations, ensuring architectural authority sits with the engineers who operate what they design.
• Influence architecture and product teams not reporting to this role to adopt the paved road, earned rather than mandated.
• Influence leaders to adopt the paved road through demonstration and collaboration.

Job description

Fullerton Health Pte. Ltd. seeks a strategic leader to design and operate a secure DevSecOps platform spanning CI/CD, observability, and governance.

You will own secure software supply chains, runtime protection, and robust incident response while driving DR readiness and compliant change management across all environments. The role demands deep expertise in modern SRE practices, GitOps, and policy-as-code, with a focus on scalable, zero-downtime delivery and cross-team influence to push