About this role
Purpose Own the DevSecOps programme for our applications and cloud platform: build security into delivery pipelines, keep cloud and Kubernetes environments secure and compliant, and manage vulnerabilities and patching against shortened timelines. Report security posture to the InfoSec Security Consultant each Program Increment (PI). Current priorities are enforcing the web application firewall (ModSecurity) and governing cloud controls (CRV) across Azure services.
Key responsibilities Secure delivery (DevSecOps)
- 1. Define the secure software delivery lifecycle: security requirements, threat modelling for key changes, and security gates in CI/CD.
- 2. Embed code, dependency, container and infrastructure scanning (SAST, SCA, image and IaC scanning) in pipelines, and manage findings to closure with agreed fix times.
- 3. Improve deployment safety by moving manual deployments toward gated, auditable pipelines.
- 1. Secure Azure and Kubernetes environments: identity and access, network isolation and private connectivity, secrets and key management, encryption and logging.
- 2. Review existing Azure services against CRV controls and close high-risk gaps. Track each fix against the matching CRV action.
- 3. Put governance in place so new services are covered before go-live: policy-as-code, controls-as-code and pipeline gates.
- 4. Use CRV monitoring, alerts and auto-remediation to prevent drift. Vulnerability and patch management
- 1. Own the process for identifying, prioritising and fixing vulnerabilities across code, images, clusters and Azure services, against shortened timelines.
- 2. Agree patch and remediation service levels with application and platform teams, and report against them.
- 3. Maintain risk acceptances with InfoSec for items that cannot be fixed in time, with mitigating controls recorded.