DevSecOps Engineer

More of our code is now written with AI. That speeds up delivery, but every change still has to be secure — and the volume of change moving through our pipelines makes that impossible to guarantee by hand. This role exists to build security into how we ship, and to keep our cloud infrastructure in good shape.

This is a hands-on engineering role, not an advisory one. You will be responsible for actioning and fixing security findings, not just reporting them. When a scan flags a vulnerable dependency, a misconfigured bucket, or an over-permissive role, you'll take technical ownership of the remediation, delivering fixes directly wherever possible and coordinating with other teams when needed.

You'll work closely with our website, internal systems, and IT teams, agreeing priorities with them and making the changes yourself wherever you can.

• →Take technical ownership of security findings across our cloud, application, and internal environments: triaging and prioritising them by real risk, delivering fixes directly wherever possible, and coordinating remediation with other teams when needed.
• →Fix issues within agreed timescales by severity, and report open findings and how long they've been open to the leadership team each month.
• →Where practical, introduce automated controls, tests, or monitoring to prevent resolved security issues from recurring.
• →Implement and maintain automated security scanning across our CI/CD pipelines, covering application code, dependencies, containers, and Infrastructure as Code (IaC). Configure and tune the tooling to identify genuine risks without unnecessarily slowing development.
• →Set guardrails for AI-written code, including checks on new dependencies and clear limits on what AI coding tools and agents can access.
• →Harden the pipelines themselves: branch protection, least-privilege permissions, and short-lived deployment credentials.
• →Own the security of our AWS environment — least-privilege IAM, S3 access, logging, and threat detection.
• →Review our existing infrastructure on an ongoing basis against recognised benchmarks such as CIS, making the updates and configuration changes required.
• →Use automation and Infrastructure as Code wherever practical to implement consistent, repeatable security improvements rather than relying on manual configuration changes.
• →Assess and improve the security of application APIs and third-party integrations, addressing authentication, authorisation, and configuration weaknesses.
• →Own the output of our vulnerability scanning, working with our IT team to get internal systems patched and configured correctly.

• A background in DevOps, platform, or cloud engineering, now specialising in security. This role needs someone who builds and fixes, not someone who only audits.
• Strong experience (typically 4+ years) across DevOps or cloud engineering, with a significant focus on security.
• Hands-on AWS security experience, including IAM, S3, CloudTrail, GuardDuty, Security Hub, and AWS Config.
• Hands-on ownership of CI/CD pipelines (e.g., GitHub Actions, Jenkins, TeamCity, Azure DevOps), including adding security gates to them.
• Practical experience implementing and managing application security tooling, including static analysis (SAST), software composition analysis (SCA), secrets scanning, and Infrastructure as Code security scanning.
• Comfortable reading and fixing application code in at least one modern language (e.g., C#, Java, Go, or similar).
• Experience with Infrastructure as Code (e.g., Terraform, CloudFormation, Pulumi), and a sharp eye for insecure configurations within it.
• Knowledge of containerisation (e.g., Docker) and how to secure images and container workloads.
• An understanding of the security risks AI-assisted development introduces, and how to manage them without slowing down delivery.
• The judgement to prioritise by real risk, alongside the confidence to take ownership, challenge existing thinking, and see fixes through.
• Security certifications (e.g., AWS Certified Security – Specialty) or experience with Cyber Essentials Plus, ISO 27001, or PCI DSS are beneficial, but not essential.

Ready to grow with us?

For Privacy information, please follow this link to our privacy notice on our website homepage:https://www.bluetreegroup.co.uk

#LI-Onsite