About this role
Senior DevSecOps Engineer
The Role
- As a Senior DevSecOps Engineer, you are the builder and operator of the pipelines, tooling, and security controls that let every engineer on this platform ship fast and ship safely. You will design, implement, and own the CI/CD infrastructure, security gates, container build pipelines, and developer tooling that govern how code moves from a developer's workstation to production. On a platform handling the financial data of millions of Africans, the pipeline is a critical control surface, and you own it end to end.
What You'll Do
- Ci/CD Pipeline Design & Ownership: Own the design, implementation, and ongoing operation of the platform's CI/CD infrastructure, ensuring every service, across every team, ships exclusively through automated, version-controlled pipelines. Build and maintain pipelines across the platform's approved CI/CD tooling, GitHub Actions, Azure DevOps Pipelines, GitLab CI, and Jenkins. No engineer has direct access to promote code to any environment manually. Every pipeline must be reproducible, auditable, and fast.
- Pipeline Quality Gates: Embed security, quality, and performance validation into every stage of the development lifecycle, enforcing mandatory, automated gates on the path to production. Implement and operate SAST, DAST, SCA, and secrets detection for security; automated test coverage thresholds, integration tests, and end-to-end test suites for quality; and load testing and performance benchmark gates to ensure no release degrades platform performance. Integrate AI-powered code review and testing agents into CI/CD pipelines, automating test generation, surfacing code quality issues early, and augmenting human review before code reaches a reviewer. No service may be promoted to staging or production without passing every gate. Work closely with the Platform Manager (Security) to define gate policies, manage exceptions, and continuously raise the bar.
- Container Build & Supply Chain Security: Own the platform's container build pipeline end to end, from base image governance to final image publication. Enforce the use of approved, minimal base images. Integrate container image scanning (Trivy) and dependency vulnerability scanning (Snyk) into every build. No container image reaches any environment without passing security scans. Maintain a software bill of materials (SBOM) for all platform services and ensure supply chain integrity is continuously monitored.
- Infrastructure as Code Pipeline Integration: Integrate all infrastructure provisioning workflows, Terraform, Ansible, and Bash, into version-controlled, automated pipelines. Enforce IaC security scanning and policy checks before any infrastructure change is applied. No cloud or network configuration may be provisioned outside of a pipeline-controlled workflow. Work with Cloud and Network Engineers to ensure infrastructure pipelines meet the same security and auditability standards as application pipelines.
- Environment Management & Dev Containers: Own the platform's environment strategy, ensuring dev, staging, and production are consistently defined, reproducible, and spun up on demand via IaC. Enforce the use of dev containers across all engineering teams, every developer works in a standardised, version-controlled development environment that mirrors production. No environment drift. No snowflake configurations.
- Secrets Management Integration: Integrate Azure Key Vault and AWS Secrets Manager, or equivalent secrets management platforms, into all CI/CD pipelines and application deployment workflows. Enforce secret rotation schedules. Ensure no secret, credential, API key, or certificate is ever hardcoded in application code, configuration files, container images, or pipeline definitions. Any violation must trigger an automated alert and mandatory rotation.
- Observability & DORA Metrics: Instrument all CI/CD pipelines with the metrics and tooling needed to track, baseline, and continuously improve the platform's engineering performance. Own the collection and reporting of DORA metrics, deployment frequency, lead time for changes, change failure rate, and mean time to recovery (MTTR). Surface these metrics to the Platform Manager in real time and use them to drive targeted pipeline improvements.
- Developer Experience & Standards: Make the right