The Infrastructure and DevSecOps Lead is responsible for overseeing the activities of the DevOps and DevSecOps Engineers within the Technology Division. This role ensures that the Technology Division's software products and infrastructure are effectively developed, deployed, and maintained to meet the requirements of clients and end-users. The Infrastructure and DevSecOps Lead is responsible for establishing and maintaining DevOps and DevSecOps processes, standards, and best practices, with a strong emphasis on integrating security into every stage of the software development lifecycle. This role provides guidance and support to DevOps and DevSecOps Engineers, and is accountable for ensuring the security, compliance, and resilience of all infrastructure, applications, and related processes. The role also champions the adoption of AI-assisted tools and practices to drive productivity, quality, and innovation across the engineering team.
Key Responsibilities:
-
Developing, Implementing, and Maintaining DevOps & DevSecOps Processes:
-
Strong ability to work in a team-oriented environment, with effective communication and collaboration skills.
-
Establish and optimize DevOps and DevSecOps methodologies and standards.
-
Ensure effective collaboration and communication between development, operations, and security teams.
-
Integrate security tools (e.g., SonarQube, Trivy, Burp Suite) into CI/CD pipelines to automate security testing during build and deployment phases.
-
Leverage AI-assisted tools (e.g., GitHub Copilot, Cursor, Antigravity, Claude) to accelerate automation, scripting, infrastructure-as-code authoring, and security analysis workflows.
-
Secure Development and Deployment:
-
Design and maintain secure configurations for cloud infrastructure using Infrastructure as Code (IaC) tools such as Terraform or CloudFormation.
-
Implement security controls and standards for containerized applications in Kubernetes, ensuring security and compliance of container orchestration environments.
-
Maintain robust security policies and documentation, covering all aspects of data protection, access control, and incident response.
-
Utilize AI tools to assist in secure code review, threat modelling, and generation of hardening documentation.
-
Cloud Security and Infrastructure Management:
-
Implement and manage cloud security solutions, particularly within AWS, utilizing tools like AWS WAF, GuardDuty, and Macie.
-
Develop and enforce IAM policies and access controls to ensure proper identity and data management across environments.
-
Conduct regular audits and reviews of cloud security configurations to identify and remediate misconfigurations and potential vulnerabilities.
-
Coordinating and Monitoring Work:
-
Supervise the work of DevOps and DevSecOps Engineers to ensure timely and accurate deliveries.
-
Oversee development, deployment, and maintenance of software products and infrastructure.
-
Implement and support monitoring solutions to ensure system health, performance, and security.
-
Monitoring, Incident Management, and Vulnerability Assessment:
-
Establish and maintain a comprehensive security monitoring and alerting framework using ELK Stack, Prometheus, and other monitoring tools.
-
Conduct regular vulnerability scans, penetration tests, and security assessments to identify risks and vulnerabilities in applications and infrastructure.
-
Lead incident response efforts, including analysis, containment, eradication, and recovery, ensuring effective and timely resolution of security incidents.
-
Document and communicate post-incident reports and security findings to relevant stakeholders.
-
Apply AI-powered tools (e.g., Claude) for log analysis, anomaly triage, and drafting incident post-mortems to accelerate response times.
-
Identifying and Addressing Issues:
-
Proactively identify and resolve infrastructure and deployment issues, inefficiencies, and inconsistencies.
-
Implement automation to improve efficiency and reduce manual intervention.
-
Address security vulnerabilities and ensure compliance with security standards.
-
Security Governance and Compliance:
-
Ensure adherence to industry standards and regulatory compliance (e.g., GDPR, CCPA, SOC-2, ISO/IEC 27001) through continuous review and implementation of security controls.
-
Create and maintain security guidelines, hardening checklists, and compliance documentation to support secure system development and operation.
-
Coordinate with internal teams and external auditors during security assessments and compliance reviews.
-
Cross-Functional Collaboration:
-
Participate alongside other Team Leads (Back-End, Front-End, Mobile App Development, QA Automation, System Analyst) and Software Architects and Head of Engineering to form a product development strategy in their area of expertise and responsibility.
-
Suggest, recommend, and implement new technologies and systems, including evaluating and standardising AI developer tools across the engineering organisation.
-
Guidance and Mentorship:
-
Provide guidance, mentorship, and support to DevOps and DevSecOps Engineers to enable their professional growth and development.
-
Foster a culture of continuous improvement, security-first mindset, and collaboration within the team.
-
Promote and enforce security best practices among team members.
-
Conduct security training sessions and workshops for development teams to promote secure coding and operational practices.
-
Champion the effective and responsible adoption of AI coding assistants (GitHub Copilot, Cursor, Antigravity, Claude) within the team, establishing guidelines for their use in infrastructure and security contexts.
Skills and Qualifications:
