DevSecOps Engineer

Requirements and responsibilities

About the Role

Flairstech is looking for a DevSecOps Engineer to join our infrastructure and security team. This role spans our production AWS and Kubernetes platform end to end — starting with the CI/CD pipelines our engineering teams rely on every day, and extending to infrastructure hardening, upgrades, and monitoring across the systems that run our core procurement application. You'll take on real, current work: closing security findings from our latest infrastructure review, modernizing components that are past end-of-support, and building the guardrails (monitoring, scanning, IaC coverage) that keep that kind of drift from recurring.

You'll partner closely with engineering teams supporting a mixed technology stack — modern Spring Boot services, a legacy Java/Scala tier, and Python-based data and AI workloads — so comfort moving between cloud infrastructure, Kubernetes, and application-adjacent debugging is more valuable here than depth in any single narrow tool.

What You'll Do

CI/CD & Release Engineering

• Build, maintain, and continuously improve CI/CD pipelines that our engineering teams rely on daily to build, test, and release software.
• Act as the go-to CI/CD resource for engineering teams — triaging pipeline failures, unblocking releases, and rolling out pipeline improvements across services.
• Support release processes for a mix of JVM-based services (Java, Scala/Play, Spring Boot) and Python services, including deployment automation and rollback tooling.
• Plan and execute upgrades of end-of-life or unsupported components (runtimes, frameworks, Lambda runtimes, database engines) with minimal production disruption.

Cloud Infrastructure & AWS

• Manage and harden AWS infrastructure across multiple accounts/environments (VPC networking, IAM, KMS, RDS, Lambda, ElastiCache).
• Remediate network and access exposures (security groups, public accessibility, VPC segmentation) and prevent recurrence through guardrails.
• Maintain and extend Terraform-managed infrastructure; close gaps where critical resources (e.g., RDS/EKS versions) aren't yet tracked in code.

Kubernetes & Containers

• Operate and upgrade our production EKS clusters, including core add-ons (VPC CNI, CoreDNS, kube-proxy) and Helm-deployed workloads.
• Manage container image pipelines: ECR repositories, image scanning, tag immutability, and cross-account image distribution.
• Keep environments (dev, staging, UAT, production) on a consistent, well-documented version cadence.

Security & Compliance

• Implement and tune detective controls (GuardDuty, Security Hub, CloudTrail, AWS Config) consistently across all environments, not just production.
• Manage TLS/certificate posture, encryption at rest and in transit, and secrets/IAM hygiene (MFA enforcement, credential lifecycle).
• Support SOC 2 and other compliance efforts by maintaining accurate infrastructure evidence and closing audit findings.
• Contribute to monitoring and observability so infrastructure and version drift are caught automatically rather than discovered during a review.

What We're Looking For

Required

• 5+ years of hands-on experience in a DevOps, DevSecOps, SRE, or infrastructure engineering role, ideally supporting production systems at scale.
• Demonstrated experience building, maintaining, and supporting CI/CD pipelines (e.g., GitLab CI, Jenkins, GitHub Actions, or similar) for multiple engineering teams.
• Strong working knowledge of AWS core services: EC2, RDS, VPC networking, IAM, KMS, Lambda, and ECR.
• Production experience running and upgrading Kubernetes (EKS or equivalent), including core networking/DNS add-ons and Helm.
• Infrastructure-as-Code experience with Terraform in a multi-environment setup.
• Practical security fundamentals: least-privilege IAM, encryption at rest/in transit, TLS/certificate management, container image scanning, and cloud security monitoring tools (e.g., GuardDuty, Security Hub, CloudTrail, Config).
• Experience with relational and/or document databases in the cloud (MySQL, PostgreSQL, or similar), including version upgrades and HA/backup configuration.
• Proficiency in at least one scripting/automation language (Python or Bash).
• Comfort working in a mixed legacy/modern stack — supporting both older runtimes (e.g., Java 8) and current frameworks (e.g., Spring Boot 3.x) during a modernization effort.

Nice to Have

• Experience remediating technical debt in a live production environment (EOL runtime upgrades, dependency/version drift, deferred releases).
• Experience with serverless (Lambda) and workflow orchestration tools (e.g., Airflow/MWAA).
• Familiarity with Redis/ElastiCache and observability platforms (e.g., New Relic, Datadog).
• AWS certification (Security Specialty or Solutions Architect).
• Experience operating in a SOC 2 or similarly audited/compliance-driven environment.