DevSecOps Architect, Multiverse

• We are looking for a pragmatic architect who combines technical expertise with a passion for enabling engineering excellence
• You do not need to meet every single point below to apply. If you are passionate about security automation and modern, AI-driven engineering practices, we want to hear from you
• Cloud Security Architecture: Experience designing secure, scalable architectures on cloud platforms. (We use AWS, but if you have strong experience in GCP or Azure, we are happy to support your transition)
• Infrastructure as Code: Experience securing Terraform codebases and building secure modules for other teams to use
• CI/CD Orchestration: Experience with modern pipelines (e.g., CircleCI, GitHub Actions, or GitLab) and integrating security steps
• Automation Engineering: Ability to write script and code (e.g., Python, Typescript) to build integrations and tooling
• Modern Detection Engineering: An interest in or experience with modern detection engineering (e.g., Google Chronicle, YARA-L, or similar SIEM tools)
• Architecture Patterns: Familiarity with securing API-first and Event-Driven Architectures
• Ambiguity: You thrive in ambiguous and fast-changing environments, and know how to make progress even when requirements are evolving
• We value practical experience and a willingness to learn over specific acronyms. While certifications like CISSP, CISM, or AWS Security are a bonus, they are not required to join our team

Desirable

• We are looking for a DevSecOps Architect to join our Information Security team
• In this role, you will be a collaborative and strategic partner to our engineering teams, helping design the automation that enables us to ship secure code at velocity
• You will advocate for a "Security by Design" culture, ensuring that robust security practices are seamlessly integrated into the fabric of our product development processes
• Your goal is to architect and build a frictionless security environment where the secure path is the easiest path for our developers
• Architect Automated Security Pipelines: Partner with the Platform team to design and implement advanced automated security controls (SAST, DAST, SCA) within our CI/CD pipelines, providing engineers with rapid, high-fidelity feedback
• Infrastructure and Policy as Code: You will guide the security architecture for our AWS environment by treating infrastructure as software enabling secure and scalable deployments and ensure automated compliance
• Threat Detection Engineering: Engineer advanced threat detection capabilities by integrating platform logs and event data (including RabbitMQ) into our SIEM (Google Security Operations). You will develop and tune YARA-L rules to proactively identify and respond to threats
• Collaborative Design and Threat Modelling: Partner with engineering squads during the design phase of new features, facilitating collaborative threat modelling sessions to build security in from the start
• Developer Enablement: Create feedback loops that deliver security insights directly into developer workflows (e.g., automated PR comments), enabling teams to self-remediate and learn continuously
• Incident Response and Operations: Participate in the team's on-call rotation, including out-of-hours coverage to support platform availability and security
• We strive to keep our rotation sustainable and low-noise to respect your work-life balance
• You will assist in troubleshooting critical issues, lead the response for security-specific incidents
• Crucially, we believe in a blameless culture, so you will drive post-mortems focused on learning and preventing recurrence