Technical Architect Azure Devops 3470

Job description

Job Title: DevSecOps Engineer Location: Ireland (Allianz Technology) Department: DevOps / Platform Engineering Reports To: Devops Lead Position Overview AZT Ireland is seeking a hands-on DevSecOps Engineer to embed security throughout our Azure-based SDLC, working within our existing DevOps toolchain and infrastructure. The role combines the platform and automation depth of our DevOps engineering practice with the security methodology defined by AZT's DPE Security function — Threat Modelling, SCA, SAST, DAST, IAST, CSPM and RASP. This is a delivery-focused role. The immediate priority is standing up and operationalising Dynamic Application Security Testing (DAST) across our pipelines and environments, in parallel with ongoing responsibility for CI/CD, infrastructure automation and container platform support. The ideal candidate is equally comfortable scripting an Azure pipeline, tuning a Kubernetes deployment, and configuring a security scanning tool against a running application. Key Responsibilities 1. DevSecOps Tooling & Pipeline Security — priority: DAST • Lead the rollout of Dynamic Application Security Testing (DAST): select/configure tooling, integrate scanning into CI/CD, and establish scan cadence (manual, scheduled, and build-triggered). • Design DAST test coverage for AuthN/AuthZ flaws, session-management vulnerabilities, configuration issues and insecure workflows across web, API and microservice applications. • Own reporting and remediation workflows for DAST findings, working with development teams to prioritise and close out vulnerabilities. • Support and extend the wider DevSecOps pipeline: Threat Modelling / security architecture review, Software Configuration Analysis (SCA) and Static Application Security Testing (SAST) at build time. • Evaluate and pilot Interactive Application Security Testing (IAST) where suited to the application stack in use. • Contribute to Cloud Security Posture Management (CSPM) — monitoring Azure configuration, compliance and vulnerabilities — and to Runtime Application Self-Protection (RASP) for production workloads. • Act as a shared-responsibility partner alongside Development, Security and Operations: automate security checks in the pipeline, harden deployment configurations, and keep systems patched and up to date. 2. GitHub Enterprise & CI/CD • Administer and optimise GitHub Enterprise (or Azure DevOps) to support development teams; build and maintain CI/CD pipelines (GitHub Actions / YAML pipelines) for build, test, security-scan and release stages. • Manage build agents (Linux and Windows), Git repositories, branching strategies (GitFlow / trunk-based) and Personal Access Token (PAT) governance. • Lead migration of source repositories from GitLab, Bitbucket, SVN and other platforms into GitHub Enterprise, ensuring data integrity, security and minimal downtime. • Implement security best practice within the GitHub Enterprise ecosystem (branch protection, secret scanning, access control). 3. Cloud Infrastructure (Azure) • Operate and improve Azure infrastructure: VMs/VMSS, Azure Kubernetes Service (AKS), Application Service Environment (ASE), Azure SQL Database, Cosmos DB, Storage (Blob/File), Data Factory. • Manage networking and security controls: VNETs, NSGs, Private Endpoints/Private Link, Application Gateway and WAF, Key Vault. • Build and maintain Infrastructure as Code using Crossplane, Terraform or ARM templates; use Packer for image creation and Ansible for configuration management. 4. Containers & Microservices • Manage AKS clusters, pod deployment and scaling, Helm charts, Istio service mesh, Flannel networking and ingress controllers. • Support containerisation practices (Docker) and container registries (Harbor, Amazon ECR, Azure ACR). • Automate deployment using Argo CD and integrate deployment automation with the broader CI/CD toolchain. 5. SDLC Toolchain & Binary Management • Manage binary repositories (Nexus) and support migration from legacy tools (e.g. Artifactory) as part of platform modernisation. • Work across the full SDLC toolchain cluster: build/package management, container registries, deployment automation and monitoring. 6. Scripting & Automation • Develop automation using Bash/Shell, PowerShell and Python (preferred) across Azure CLI, Azure PowerShell and REST APIs. • Build scripts and tooling to automate security checks, infrastructure changes and repetitive operational processes. 7. Databases • Support Azure SQL administration, performance tuning, backup/restore and on-premises-to-Azure migration. • Support NoSQL platforms — MongoDB (PaaS and VM-hosted) and Azure Cosmos DB. 8. Monitoring & Observability • Maintain dashboards and alerting in Dynatrace (primary platform), Grafana, Kibana (ELK), Azure Monitor/Log Analytics and Application Insights. • Support incident management, log analysis, troubleshooting and performance monitoring across environments. 9. Collaboration • Work in agile teams using Jira for issue tracking and Confluence for documentation; contribute to agile ceremonies and continuous improvement. • Partner with development, operations and security teams to understand needs, provide solutions, and troubleshoot toolchain issues. • Provide training and support on best practice within GitHub Enterprise and the wider DevSecOps toolchain. DevSecOps Methodology — Practices Covered by This Role The table below reflects AZT's DevSecOps approach: security integrated continuously across the SDLC rather than concentrated at the end. DAST is the current priority delivery focus. Practice (SDLC Stage) Scope & Focus Threat Modelling (Plan / Design) Identify threats against architecture components — user interfaces, data flows, data processes, data storage. Rate and prioritise remediation. Supported by AZT's global Threat Modelling service. Software Configuration Analysis — SCA (Develop) Detect vulnerabilities in open-source dependencies; produce SBOMs and check licence attribution/compliance. Typically bundled with SAST tooling (GHAS). Static Application Security Testing — SAST (Build) Analyse source code for vulnerabilities before runtime, without executing the application. Performed once code is feature-complete; earliest and cheapest point to fix defects (shift-left). Dynamic Application Security Testing Simulate real-world attacks against the running application: crafted requests, response analysis, and detection of AuthN/AuthZ flaws, session-management issues, misconfiguration and insecure workflows. This is a priority project for AZT Ireland and the primary near-term focus of this role. Interactive Application Security Testing — IAST (Test) Agent/sensor-based testing that combines SAST- and DAST-style visibility across code, data flow, requests/responses and configuration; traces exploitable vulnerabilities back to source. Suited to web, mobile, microservice and API-based applications; tool selection depends on the application stack in use. Cloud Security Posture Management — CSPM (Release / Deploy) Continuous monitoring of cloud configuration, compliance and vulnerabilities across cloud services and resources; unifies visibility across providers into a single console. Runtime Application Self-Protection — RASP (Operate / Monitor) Embedded security agents that monitor application behaviour and block attacks in real time at the application layer, complementing network-level controls. Qualifications Required • Bachelor's degree in Computer Science, Information Technology, or related field (or equivalent hands-on experience). • Proven DevOps/DevSecOps experience with a strong focus on the GitHub Enterprise ecosystem and CI/CD pipeline creation (GitHub Actions). • Hands-on experience with Azure infrastructure services listed above, and with Infrastructure as Code (Terraform, ARM, or Crossplane). • Practical experience with at least one application security testing practice (SAST, DAST or IAST); willing