Principal Security Architect — DevSecOps (Group Manager II - Information Security)

Job summary

The Principal Security Architect — DevSecOps is tasked with embedding security throughout the engineering lifecycle, focusing on secure engineering patterns and automation of controls. Key responsibilities include defining the DevSecOps strategy, implementing automated security measures across CI/CD pipelines, and guiding secure architecture for APIs and microservices, utilizing technologies such as Kubernetes, IAM, and policy-as-code.

Qualifications

• 8+ years in software, security, cloud security, DevSecOps, or platform engineering (10–15 ideal), with production platform ownership.
• Strong software engineering background — able to read application code, system design, CI/CD workflows, infrastructure automation, and runtime behaviour.
• Proven experience securing cloud-native platforms in production.
• Deep secure-SDLC knowledge: secure design and coding, threat modeling, automated testing, vulnerability and dependency management, release controls, and production readiness.
• Experience integrating SAST, DAST, and SCA into CI/CD in a practical, automated way.
• Container security: image scanning, base-image strategy, registry controls, remediation, runtime configuration, and secure workload deployment.
• Kubernetes security: cluster hardening, namespace isolation, RBAC, admission control, network policies, workload identity, pod security, secrets, ingress, and runtime protection.
• Familiarity with policy-as-code (OPA, Gatekeeper, Kyverno, or equivalent).
• Knowledge of secrets management: secure storage, rotation, access control, pipeline integration, runtime injection, and governance.
• Experience with CI/CD security automation: pipeline hardening, artifact integrity, dependency controls, environment promotion, deployment approvals, rollback safety, and supply-chain security.
• Strong communication skills for explaining architecture, risks, and trade-offs to distributed teams.
• Mentoring and technical leadership that raises the standard of surrounding engineers.

Responsibilities

• Define and evolve the DevSecOps strategy for a cloud-native banking transformation platform.
• Embed security across the SDLC — design, coding, build, test, deployment, runtime, monitoring, and incident response.
• Design and implement automated security controls across CI/CD pipelines, infrastructure provisioning, application delivery, container images, Kubernetes, and cloud services.
• Integrate and operationalize SAST, DAST, SCA, container scanning, secrets scanning, and policy-as-code.
• Define secure engineering standards and reusable guardrails for teams.
• Apply cloud-native security patterns: IAM, network segmentation, workload identity, secrets management, least privilege, zero trust, runtime security, and auditability.
• Guide secure architecture for APIs, microservices, event-driven systems, SaaS integrations, and developer tooling.
• Partner with platform, backend, DevOps, QA, product, and delivery teams to integrate security.
• Mentor engineers through design reviews, threat modeling, code and pipeline reviews, and pairing.
• Ensure production systems are secure, observable, resilient, compliant, and ready for regulated banking.

Skills

Relocation