DevSecOps Architect

Position: DevSecOps Architect – Platform Engineering & Supply Chain Security

Location: Remote- Montreal QC

Job type: Full-Time/Permanent Hiring

Lead architecture, governance, and evolution of enterprise DevSecOps platforms and software delivery pipelines across Agile Release Trains. Design and validate DevSecOps solutions through hands-on POCs before enterprise rollout. Define CI/CD standards, govern container security, Kubernetes/GKE integration, Sonatype Nexus, and software supply chain security (SAST, SCA, SBOM, signing, policy enforcement).

Key Responsibilities:

• Lead enterprise DevSecOps platform architecture, governance, and evolution across Agile Release Trains
• Design, document, validate, and demonstrate DevSecOps solutions via hands-on POCs before rollout
• Define CI/CD standards: source control, branching, PRs, releases, multi-stage YAML pipelines, approvals, embedded security controls
• Govern container image security: registries, scanning, signing, SBOM generation, provenance, promotion, vulnerability management, immutability
• Partner with Cloud Architecture on secure Kubernetes/GKE deployments, admission controls, Helm, GitOps, workload identity, pipeline integration
• Design and govern Sonatype Nexus for secure repository access, dependency controls, lifecycle management, artifact traceability
• Integrate SAST, SCA, secret scanning, IaC/container scanning, attestations, signing, policy enforcement into delivery workflows
• Support architecture reviews, risk assessments, audit evidence, remediation, and alignment with cybersecurity/enterprise standards
• Evaluate and apply AI-assisted tools for pipeline development, documentation, testing, compliance validation, vulnerability triage
• Build reusable pipeline templates, scripts, integrations, secrets-management workflows, service-management automation at enterprise scale
• Guide and mentor application teams, DSO Champions, platform teams, and junior resources through standards and best practices

Required Skills:

Primary: Enterprise DevSecOps architecture, CI/CD governance, YAML pipelines, Kubernetes/GKE security, Helm, GitOps, admission controls, workload identity, Sonatype Nexus, SBOM generation, image signing, Sigstore/Cosign, SLSA, SAST, SCA, secret scanning, IaC scanning, container scanning, policy enforcement (OPA/Rego, Kyverno), software supply chain security, risk assessments, audit evidence, applied AI for DevSecOps, platform engineering, reusable pipeline templates, secrets management, technical leadership, mentoring, Agile Release Trains, POCs

Tools/Frameworks: GitHub Actions, GitLab CI, Azure DevOps, Jenkins, ArgoCD, Flux, Docker, Sonatype Nexus (Repository Manager, Lifecycle, IQ Server), Snyk, Trivy, Syft, Grype, Semgrep, Sigstore (Cosign, Fulcio, Rekor), HashiCorp Vault, Azure Key Vault, AWS KMS, CycloneDX, SPDX, Veracode, Checkmarx, Aqua Security, Prisma Cloud, Terraform, Python, Bash, Go, Git, Jira, Confluence, ServiceNow, GitHub Copilot, CodeQL, Falco, Prometheus, Grafana, ELK, Splunk

Database/Cloud: GCP (GKE, Artifact Registry, KMS, Secret Manager), Azure (AKS, ACR, Key Vault), AWS (EKS, ECR, KMS, Secrets Manager), Harbor, JFrog Artifactory, Entra ID, Okta, Ping Identity, SSO/SAML/OIDC, RBAC/ABAC, audit logging, multi-cloud, hybrid cloud