DevSecOps Engineer – Remote Work Type

Directio

28d•Remote

About The Position

Directio is a global IT services company. We consult, code, test, deploy, and manage mainly cloud-based and mobile applications, providing around-the-clock support from our offices in Poland, the Philippines, Mexico, and the USA. We prepare our FMCG, retail, automotive, and SaaS clients for the future by accelerating their digital transformation. Operating under the “We Code Success” principle, we prioritize the success of our clients, consultants, and partners. About project We are looking for a DevSecOps Engineer to join a project for our client, an international company operating across multiple markets. You will be joining a small platform team responsible for Azure, Kubernetes, deployments, Microsoft 365, and on-call support. This is a hands-on role combining platform engineering and DevOps responsibilities with ownership of security engineering practices. You will be supporting our client’s migration from a monolithic architecture to services, building the required infrastructure, environments, CI/CD pipelines, and observability while ensuring the stability of the existing platform. At the same time, you will be responsible for strengthening security practices across the organization and supporting the technical side of the ISO 27001 certification journey.

Requirements

5+ years of professional experience in Platform Engineering, DevOps, or a similar role
Strong hands-on experience with Microsoft Azure and Kubernetes/AKS in production environments, including building clusters, pipelines, and environments, performing upgrades, and supporting production systems
Hands-on experience in security engineering and have taken ownership of security-related processes rather than only supporting them
Experience with the technical side of ISO 27001 or an equivalent security framework, or you have managed vulnerability management processes end-to-end
Practical knowledge of security tooling and practices, including external attack surface monitoring, DAST, SAST, SCA, secrets scanning, container scanning, and cloud security posture management
Experience with Azure DevOps and CI/CD pipelines
Experience with Infrastructure as Code and infrastructure automation
Scripting and automation skills using Bash, PowerShell, or Python
Comfortable documenting technical processes and security controls and communicating technical topics clearly to customers, security teams, and auditors
Able to independently prioritize tasks and take ownership in a small, senior team environment
Fluent in English

Nice To Haves

Knowledge of Estonian or German
Previous experience working with enterprise or banking customers and supporting customer security audits
Experience supporting organizations through security certification programmes
Experience working on modernization projects involving migration from monolithic architectures to services

Responsibilities

Running and maintaining the platform together with the team, working with Azure, AKS, deployments, upgrades, incident response, and on-call support
Building and operating infrastructure required for the migration from a monolithic architecture to services, including environments, CI/CD pipelines in Azure DevOps, Infrastructure as Code, monitoring, and alerting
Managing the external attack surface, maintaining an inventory of internet-facing assets, monitoring potential exposures, and ensuring vulnerabilities are addressed effectively
Integrating security into Azure DevOps and Kubernetes delivery pipelines, including code, dependency, secrets, container, and Infrastructure as Code scanning
Establishing and maintaining the Azure and Microsoft 365 security baseline, including identity and access management, MFA, cloud security posture, Microsoft Defender, and access management processes
Managing the vulnerability management process end-to-end, from identifying vulnerabilities and coordinating fixes to verifying their resolution and maintaining appropriate evidence
Responsible for the technical security controls supporting the ISO 27001 certification programme, working closely with the compliance lead
Providing technical input for customer security questionnaires and audits and participating in discussions with customers and auditors when deeper technical expertise is required
Supporting penetration testing activities performed by an external partner, including defining the scope, coordinating testing activities, and ensuring identified findings are properly addressed
Automating operational and security processes wherever possible and continuously improving the reliability and security of the platform