DevSecOps Engineer

The DevSecOps Engineer will act on behalf of the Firm's information security team to embed security controls and principles within the software development lifecycle. The role holder will serve as a bridge between security, development, and other technical teams to build secure CI/CD pipelines, contribute to IaC efforts, and provide expert consultation on matters affecting the security and development groups.

Responsibilities:

• Implement and oversee secure development practices across the Firm's technical teams with a primary focus on the Firm's development and IaC efforts
• Serve as a trusted advisor relative to tools, methods, controls, and control measurement
• Identify technical and procedural gaps in the current environment and evaluate, implement, and oversee their remediation
• Architect, build, deploy, and maintain scripts, templates, and other components as needed to address secure process automation in a hybrid mode environment

Skills and Experience:

• Computer Science Bachelor’s degree or substantial equivalent experience
• CISSP, CCSK, CCSP, GSDC,GCSA, CDP
• Extensive experience with the design, development, and general practices related to secure development
• Extensive experience with IaC tools, Terraform, Ansible, Chef, Docker, Kubernetes
• Comfortable with applying DevSecOps principles across PaaS (e.g. Kubernetes AKS/WebApps/Keyvault/etc.) and IaaS (e.g. NSG's/VM's/etc.)
• Experience with executing, interpreting and remediating findings associated with application security assessments and penetration tests
• Strong knowledge and understanding of cloud security frameworks such as NIST, CSA, CCM, MITRE ATT&CK
• Excellent knowledge of API security and microservices architectures.
• Proficient with developing and utilizing scripts and other tools to automate application and infrastructure build, configuration, maintenance, and oversight tasks in a Microsoft-centric environment
• Experience with risk analysis, business reporting, and documentation
• Experience with DAST and SAST tools and integration into SDLC
• Proficient with Azure native security controls
• Extensive experience with architecting Azure DevOps CI/CD pipelines containing robust security controls and oversight
• Working knowledge of the principles, theories, techniques, and methods of information system analysis and programming.
• Expert knowledge of cloud security technologies, standards, and controls
• Expert analytical skills, including the gathering and analyzing of facts, formulating objective conclusions modified by subjective and experience-based qualifiers when appropriate, defining problems, and promoting solutions
• Ability to adapt, integrate, and modify existing programs or vendor-supplied package programs for use with existing information systems
• Proficient in oral and written English
• Ability to be productive and maintain focus without direct supervision

Interested applicants may also apply via Career Opportunities (bakermckenzie.com)

Job Type: Full-time

Application question(s):

• Will you now or in the future require sponsorship for employment visa status?

Work authorisation:

• United Kingdom (required)

Work Location: In person