DevSecOps Engineer

About the role

We are global private markets specialists delivering tailored investment solutions, advisory services, and impactful, data driven insights to the world’s investors. Leveraging the power of our platform and our peerless intelligence across sectors, strategies, and geographies, we help identify the advantages and the answers our clients need to succeed.

The DevSecOps Engineer is responsible for embedding security into the software development lifecycle and the firm's CI/CD pipelines, with primary focus on application security guardrails, developer-facing tooling, and secure engineering practices. The role also maintains hands-on cloud security expertise, primarily on AWS with working proficiency across Azure, to harden posture and reduce exposure. Sitting within Infrastructure Engineering, the role partners closely with application development, platform, and DevOps teams to build guardrails that get adopted rather than imposed, protecting systems and data while supporting delivery speed.

Key Responsibilities

- Own and continuously mature the firm's DevSecOps program, embedding SAST, DAST, SCA, infrastructure-as-code and secrets scanning, and policy gates directly into CI/CD pipelines to catch issues before deployment.

- Partner with application development teams to threat-model new services and features at design time, translating findings into concrete guardrails and remediation guidance developers can act on.

- Build and maintain secure-by-default patterns, reusable infrastructure-as-code modules, and golden pipeline templates that engineering teams adopt by default.

- Operationalize the firm's cloud-native application protection platform (Wiz): triage, prioritize, and remediate findings across cloud and application layers, reducing backlog and mean time to remediate.

- Establish and codify cloud security guardrails primarily on AWS, including Service Control Policies, Config rules, public-access blocking, default encryption, and tagging baselines.

- Harden identity and access (IAM roles, policies, permission boundaries, and least privilege) and network exposure across cloud workloads.

- Extend posture management and guardrails to Azure, using tools such as Microsoft Defender for Cloud, Azure Policy, Entra ID, and equivalent GCP controls.

- Drive down internet-facing exposure, targeting zero critical and high-severity findings across public-facing workloads and applications.

- Provide security evidence and controls in support of SOC 2, audit, and regulatory requirements, with emphasis on evidencing secure SDLC practices.

Required Skills

- Strong, hands-on experience embedding security into CI/CD pipelines and the SDLC: SAST, DAST, SCA, infrastructure-as-code scanning, secrets management, and policy-as-code/gating.

- Practical application security background, including threat modeling and secure coding guidance, with a track record of working directly with developers to land fixes without becoming a blocker to delivery.