Devsecops Engineer

Sutherland; United States; Remote; USD 140,000 - 180,000; Full time

Job summary

Sutherland is seeking a seasoned DevSecOps Engineer to embed security across our cloud infrastructure and software delivery pipelines. You will secure GCP/AWS, Kubernetes clusters, CI/CD pipelines, and internal endpoints while preserving engineering velocity.

You will own shift-left security and partner with Platform, CloudOps, and application teams. The role requires 7+ years in DevSecOps, hands-on cloud security, IAM design, and compliance experience (SOC 2, HIPAA, ISO 27001).

Qualifications

• 7+ years in DevSecOps or infrastructure security.
• Experience securing Kubernetes clusters in production.
• Proven experience with cloud security services (GCP/AWS) and IAM design.
• Strong CI/CD security knowledge and integrated scanning.
• Experience reducing cloud attack surface and threat modelling.
• Clear communication and ability to write runbooks.

Responsibilities

• Own CSPM across GCP and AWS with remediation tracking.
• Design IAM policies and least-privilege access for multi-cloud workloads.
• Enforce VPC security controls, private endpoints, and audit surface areas.
• Secure external-facing services with internal load balancers and VPNs.
• Manage secrets with Secret Manager/AWS Secrets Manager; rotate credentials.
• Lead cloud security incident response across cloud and Kubernetes.
• Own SOC 2, HIPAA, ISO 27001 compliance evidence and gap analysis.
• Conduct threat modelling and architecture risk assessments.
• Harden GKE clusters with CIS benchmarks and pod security standards.
• Implement network policies for east-west segmentation.
• Operate runtime security tooling (Falco).
• Manage Kubernetes RBAC with least-privilege principles.
• Secure container supply chain with image scanning (Trivy/Snyk).
• Implement Istio security controls (mTLS, policies).
• Audit workloads for security drift and secrets in env vars.
• Secure GitLab CI/CD end-to-end; protect runners and MR approvals.
• Integrate SAST/DAST, dependency and container scanning.
• Enforce IaC security scanning as a gate for Terraform changes.
• Manage GitLab token hygiene and rotation policies.
• Define pipeline security policies as code.

Skills

DevSecOps

Cloud security

Kubernetes security

CI/CD security

Threat modelling

Communication skills

Tools

GCP

AWS

Kubernetes

GitLab

Terraform

Datadog

Istio

Falco

Job description

DevSecOps Engineer

Cloud Security • Kubernetes Security • Pipeline Security

Location: Remote

Type: Full-time • Senior • 7+ years

ABOUT THE ROLE

We are looking for a DevSecOps Engineer who will embed security into every layer of our cloud infrastructure and software delivery pipeline. Your primary responsibility is to ensure our GCP and AWS environments, Kubernetes clusters, CI/CD pipelines, and internal endpoints are secure, compliant, and hardened without slowing down engineering velocity. You will own the shift-left security culture, partnering closely with platform, CloudOps, and application teams.

RESPONSIBILITIES

Cloud Security — Primary

• Own cloud security posture management (CSPM) across GCP and AWS — continuous assessment, misconfiguration detection, and remediation tracking.
• Design and enforce IAM policies, service account hygiene, least-privilege access controls, and workload identity across multi-cloud environments.
• Implement VPC security controls — private service access, firewall rules, network policies, ingress/egress restrictions, and Private Google Access.
• Internalise and secure service endpoints — move external-facing services to internal load balancers, private endpoints, and VPN/interconnect. Continuously audit and reduce the public attack surface.
• Manage secrets hygiene — enforce Secret Manager (GCP) and AWS Secrets Manager, eliminate hardcoded credentials, and rotate secrets programmatically.
• Lead cloud security incident response — triage, contain, investigate, and remediate across cloud and Kubernetes environments.
• Own compliance reporting for SOC 2, HIPAA, and ISO 27001 — evidence collection, gap analysis, and control implementation.
• Conduct regular threat modelling, security reviews, and architecture risk assessments.

Kubernetes Security — Primary

• Harden GKE clusters — CIS benchmarks, pod security standards (restricted/baseline), and admission control policies.
• Implement and manage network policies to enforce east-west traffic segmentation between namespaces and services.
• Deploy and operate runtime security tooling (e.g. Falco) for threat detection inside cluster workloads.
• Manage Kubernetes RBAC with least-privilege principles. Audit and remediate overpermissioned service accounts.
• Secure the container supply chain — image scanning in CI (Trivy/Snyk), enforce signed images, and maintain a trusted registry policy.
• Implement Istio security controls — mTLS enforcement, authorisation policies, and east-west traffic observability.
• Continuously audit running workloads for security drift — privileged containers, host path mounts, and secrets in environment variables.

CI/CD & GitLab Security — Primary

• Secure the GitLab CI/CD pipeline end-to‑end — protect runner environments, restrict pipeline permissions, enforce branch protection and MR approvals.
• Integrate SAST, DAST, dependency scanning, container scanning, and secret detection natively into GitLab CI. Own the triage and remediation workflow.
• Implement IaC security scanning (tfsec, Checkov) as a mandatory pipeline gate for all Terraform changes.
• Manage GitLab token hygiene — enforce expiry policies, rotate project tokens, and audit personal access token usage.
• Define and enforce pipeline security policies organisation-wide using GitLab security policy‑as‑code.

Endpoint & Network Security — Primary

• Audit and reduce the external attack surface — inventory all public endpoints and drive internalisation of services that do not need to be public.
• Implement and maintain WAF and Cloud Armor rules to protect externally exposed services.
• Enforce TLS certificate management — automate issuance, rotation, and enforce TLS 1.2+ across all endpoints.
• Manage bastion host security — enforce short‑lived certificates (OS Login / IAP), eliminate persistent SSH keys, and log all administrative sessions.
• Own DNS security controls — DNSSEC, private DNS zones for internal services, split‑horizon DNS where required.

Security Engineering & Automation

• Build security automation pipelines — policy enforcement, compliance checks, and vulnerability remediation as code.
• Instrument security observability in Datadog — threat detection dashboards and alert tuning for cloud and Kubernetes signals.
• Develop and maintain runbooks for security incidents, vulnerability response, and access reviews.
• Champion security training and awareness. Conduct secure code reviews and threat modelling workshops.

TECH STACK

Required

• GCP — Security Command Center, IAM, VPC Service Controls, Cloud Armor, Secret Manager, Binary Authorization
• AWS — GuardDuty, Security Hub, IAM, KMS, Macie, AWS Config
• Kubernetes — GKE hardening, pod security standards, network policies, RBAC, admission controllers
• GitLab — CI/CD security, SAST/DAST, dependency scanning, pipeline policy management
• Terraform — IaC security scanning (tfsec, Checkov), secure module design
• Datadog — security monitoring, threat detection, alert management
• Istio — mTLS, authorisation policies, service mesh security

Good to have

• Falco, OPA/Gatekeeper, HashiCorp Vault, Wiz/Orca/Prisma Cloud, Trivy/Snyk, SIEM (Splunk/Chronicle), Python or Go

REQUIREMENTS

Must have

• 7+ years in DevSecOps, cloud security, or infrastructure security engineering.
• Deep hands‑on experience securing Kubernetes clusters in production — RBAC, network policies, pod security, and runtime protection.
• Proven experience with GCP and/or AWS security services and IAM design.
• Strong CI/CD security knowledge — pipeline hardening, secrets management, and integrated scanning.
• Experience internalizing service endpoints and reducing cloud attack surface.
• Familiarity with HIPAA, SOC 2, or ISO 27001 compliance in regulated environments.
• Clear communication skills — able to explain a critical vulnerability to a CTO and write a runbook for an engineer.

Nice to have

• Certified Kubernetes Security Specialist (CKS).
• Google Professional Cloud Security Engineer or AWS Security Specialty certification.
• eBPF-based security tooling (Cilium, Tetragon), penetration testing, or red team experience.
• Threat modelling using STRIDE or PASTA. Service mesh security beyond Istio.

HOW SUCCESS IS MEASURED

• Reduction in critical and high vulnerabilities in cloud and container environments over time.
• % of CI/CD pipelines with security scanning fully integrated and enforced as a gate.
• Attack surface reduction — number of externally exposed endpoints successfully internalised.
• Mean time to detect and respond to security incidents (MTTD / MTTR).
• Compliance posture score — evidence coverage for SOC 2, HIPAA, ISO 27001.
• Zero hardcoded secrets or publicly exposed service accounts in production.