DevSecOps Engineer

CreateFuture; United States; Hybrid; USD 120,000 - 180,000; Full time

Job summary

CreateFuture ищет опытного Lead DevSecOps Engineer для руководства программами облачной и прикладной безопасности у клиентов. Вы будете внедрять архитектурные решения, проводить threat modelling и обзоры кода, а также развивать AI‑инструменты безопасности.

Кандидат имеет опыт в регламентированных секторах и в SDLC, работает с AWS/Azure и IaC, способен коммуницировать на уровне руководства и наставлять команды в безопасных практиках DevSecOps.

Qualifications

• Опыт на должности Lead/Principal DevSecOps или Application Security.
• Опыт в regulated сферах (iGaming, финансы, здравоохранение)
• Опыт с CI/CD и IaC (GitHub Actions, Terraform)
• Углублённый AWS и Azure security опыт (Entra ID, Defender и т.д.)
• Глубокие знания OWASP, безопасного SDLC
• Опыт проведения тестирования на проникновение и threat-моделирования
• Опыт в обзоре безопасной архитектуры и кода
• Знание infosec процессов: GRC, TPRM, SOC

Responsibilities

• Ведение облачной и прикладной безопасности для клиентов на протяжении SDLC.
• Разработка и внедрение AI‑инструментов безопасности на базе Claude Code, StrandsAgent и AWS AgentCore
• Проведение threat modelling, архитектурных обзоров и тестирования на проникновение
• Коммуникации с стейкхолдерами на уровне руководства и руководство проектами
• Содействие внедрению стандартов внутренней безопасности через Security Council
• Обучение и адаптация DevSecOps команд к современным практикам

Skills

Лидирование DevSecOps

Обеспечение безопасности облака

Безопасность приложений

Threat modelling

Тестирование на проникновение

CI/CD

Terraform

AWS Security

Azure Security

GRC / регулированные среды

Tools

AWS

Azure

Terraform

GitHub Actions

Azure DevOps

JavaScript

C#

Java

.NET

React Native

Node.js

Claude Code

StrandsAgent

AWS AgentCore

OWASP ZAP

Burp Suite

Security Hub

GuardDuty

Sentinel

Defender

Job description

Задачи:

Cloud Security – Own the cloud security posture for clients, designing and implementing security controls across AWS and Azure using Terraform (including Control Tower, Security Hub, GuardDuty, Azure Entra ID, Defender, and Sentinel) while driving continuous posture improvements (CSPM). Application Security – Own the application security posture for clients, establishing frameworks covering secure development policy and AppSec Maturity Models while performing architecture and code reviews to guide them from current to target state. Security Assessment – Deliver security assessments across client projects, incorporating application and infrastructure penetration testing, automated cloud infrastructure scanning, and in-depth reviews of architecture and source code security to provide actionable remediation guidance. AI-Powered Security Tooling and Platform – Build and evolve AI-driven security tooling and platform using Claude Code skills, hosted agents via StrandsAgent, and AWS AgentCore — automating security workflows and increasing coverage at scale. Compliance & Governance – Perform compliance analysis against regulations such as GDPR, GLI and PCI DS, identify security requirements, and implement controls aligned to regulatory standards on client projects. Stakeholder Communication – Present security posture, risk findings, and remediation roadmaps to executive stakeholders, effectively managing expectations and aligning risk mitigation strategies with business priorities. Internal Security & Best Practices – Contribute to the enhancement of security best practices throughout Createfuture, actively engaging via the Security Council to drive internal security standards and governance. Mentoring & Onboarding – Coach and onboard DevSecOps engineers, and development teams on modern security practices.

Требования:

• Proven experience in a Lead or Principal DevSecOps / Application Security engineering role
• Experience in iGaming, lottery, or other highly regulated digital sectors such as finance, banking
• Experience with highly regulated environments (GDPR, GLI, PCI DSS, CFTC)
• Experience with CI/CD, infrastructure-as-code skills such as github actions and Terraform.
• Hands‑on AWS security experience and Azure security experience (Entra ID, PIM, CAP, Defender, Policy)
• Deep knowledge of OWASP frameworks, secure SDLC, and application security assessment
• Experience conducting or coordinating penetration testing and threat modelling
• Experience with secure code and architecture review, ideally in regulated or high‑compliance environments such as iGaming, fintech, or healthcare
• Familiar with how the infosec team operates, including GRC, TPRM and SOC capability.
• Strong communication skills with the ability to influence at senior stakeholder level
• Experience building AI‑powered security tooling using Claude Code, StrandsAgent, AWS AgentCore, or similar agentic frameworks
• Experience working in SDLC as Dev or DevOps or cloud engineer
• Azure AZ‑500, SC‑100 or SC‑200 certificate AWS Security Specialty certification or solution architect
• Tech Stack AWS | Azure | Terraform | GitHub Actions | Azure DevOps | JavaScript | C# | Java | .NET | React Native | Node.js | Claude Code | StrandsAgent | AWS AgentCore | OWASP ZAP | Burp Suite | Security Hub | GuardDuty | Sentinel | Defender
• What we’ll offer you: We trust people to do their best work. That means flexibility over rigid rules, impact over activity, and real investment in your growth both professionally and personally. You’ll be part of a supportive, and friendly culture, surrounded by smart, curious people who care deeply about what they do. We offer flexible working, including hybrid and remote options. Our office hubs are located in Edinburgh, Leeds, Manchester, London and Bulgaria, with occasional travel to client sites or CreateFuture offices when needed. We trust you to manage your time balancing collaboration with client time and focused work. What matters is the impact you have, not how busy you look.
• Inclusion at CreateFuture We believe diverse teams build better workplaces and better products. We want CreateFuture to be a place where people feel able to be themselves and do their best work. If you need any adjustments or support during the application process, just. We will do what we can to help.

Условия:

CreateFuture is an AI-native consulting partner where people do work that matters and are supported to do it well. We work alongside organisations such as PayPal, adidas, NatWest, FanDuel and Money Saving Expert, building digital products and services that make a difference while always putting people first. We’re a team of creators. We write code, shape delivery, build go‑to‑market strategies, develop AI solutions and create the practices that support our people. We work side by side with our clients, challenging what’s not working and helping them to build the future. Our commitment to craft, quality, and culture has helped us scale to over 600 people in just a few years. CreateFuture is a Great Place to Work-Certified™ company and has won Best Workplaces UK multiple years in a row. Join us on our journey. Let’s create tomorrow, together, today.

We are looking for an experienced Lead DevSecOps Engineer to join our growing Security practice. In this role you will drive cloud and application security across client engagements — embedding security thinking into every stage of the SDLC, platform building, mentoring engineers, and helping CreateFuture build world‑class DevSecOps capabilities. Our clients span regulated and high‑stakes industries including iGaming, healthcare‑tech, e‑commerce, and financial services. You will work hands‑on with these clients — conducting threat modelling, secure architecture reviews, and penetration testing — while also shaping the internal AI‑powered security tooling that sets CreateFuture apart.