Role Overview:

As a Staff DevOps Engineer on the DevSecOps team, you are the technical authority for how security is designed into the company's cloud-native platform. You will define the DevSecOps reference architecture, own the secure paved road from code commit to production, and set a multi-quarter technical roadmap for platform security.

Architecture & Technical Strategy:

- Security Architecture: Define and evolve the DevSecOps reference architecture and secure-by-design standards adopted across engineering - covering cloud infrastructure, Kubernetes, containers, and CI/CD.

- Technical Roadmap: Own the multi-quarter DevSecOps roadmap. Make and defend build-vs-buy, tooling-consolidation, and platform-investment decisions.

- Design Authority: Author and review design docs and RFCs for security-critical infrastructure.

- Ambiguity to Execution: Take loosely defined, multi-team security initiatives and decompose them into scoped, sequenced, executable roadmaps.

Platform & Pipeline Ownership:

- Secure Paved Road: Own the golden-path CI/CD pipeline - set gating policy, severity thresholds, and break-the-build rules.

- Shift-Left Automation: Drive SAST, DAST, SCA, IaC scanning, container image scanning, and secret detection into pipelines.

- Infrastructure Hardening: Design and automate security controls across AWS/Azure/GCP resources, Kubernetes clusters, and service meshes.

- Policy-as-Code: Establish and scale guardrails using OPA/Rego, Kyverno, and admission controllers.

- Supply-Chain Security: Own artifact provenance and integrity - SBOM generation, artifact signing, and dependency provenance.

- Secrets & Identity: Architect secrets management and workload identity at scale - Vault/KMS, dynamic credentials, and least-privilege IAM.

Detection, Response & Governance:

- Threat Detection: Design monitoring, alerting, and detection-as-code for infrastructure and pipeline security signals.

- Incident Leadership: Lead security incident triage and response for infrastructure and pipeline events.

- Vulnerability Management: Own the end-to-end vulnerability lifecycle at platform scale.

- Compliance Engineering: Translate SOC 2, ISO 27001, PCI-DSS, and GDPR/CCPA obligations into automated technical controls.

- Risk Arbitration: Frame security risk versus delivery velocity for engineering leadership.

Leadership & Influence:

- Cross-Org Leadership: Co-own security standards with Cloud Security and Product Security.

- Mentorship: Mentor senior and mid-level DevOps engineers.

- Security-First Culture: Build and run the enablement layer - internal documentation, secure-by-default templates, and training.

- Continuous Improvement: Track emerging threats, vulnerabilities, and industry practice.