DevSecOps Engineer

IDScan.net is hiring a DevSecOps Engineer to build and mature its security tooling and software development practices. The role owns identity infrastructure, API and CI/CD security, infrastructure-as-code, zero trust network access, and endpoint device posture.

Responsibilities:

• API security and lifecycle. API gateway as a mandatory front door so no service can exist outside our inventory, and build an API register with owners and lifecycle state enforced in CI
• Identity infrastructure. Consolidate a split Active Directory and Entra ID estate into a single directory. Build automated joiner-mover-leaver provisioning between our HR system and our identity provider using API-driven inbound provisioning
• Zero trust network access. Replace our VPN with per-application access. Application discovery, connector deployment, policy authoring, phased cutover, and a properly documented decommission
• Pipeline security. Integrate SAST, DAST, dependency and secret scanning into CI as gates rather than reports. Own the developer experience of this and work with them to build processes that will be followed
• Infrastructure as code. Bring our Azure estate under Terraform or Bicep with policy-as-code guardrails, so configuration drift becomes visible instead of discovered
• Endpoint and device posture. Device compliance signals feeding Conditional Access, which is a prerequisite for the zero trust work above

Requirements:

• 4+ years in a DevOps, platform, cloud or security engineering role, with meaningful ownership of production infrastructure
• Strong Azure experience: RBAC, networking, Key Vault, managed identities, Defender for Cloud
• Real CI/CD depth: you've built pipelines, not just used them
• Infrastructure as code in production (Terraform, Bicep, Pulumi)
• Comfortable writing code, not just configuration. Python, Go, PowerShell or similar
• Practical identity knowledge: OIDC, SAML, SCIM, Conditional Access, service principals
• API security fundamentals: authentication and authorization patterns, gateway architecture, the OWASP API Top 10
• You've worked somewhere with an audit and understand why evidence matters, even when it's tedious
• Experience working with overseas teams
• GitHub Actions preferred
• Experience migrating between identity providers or collapsing a dual-directory estate
• ZTNA deployment experience with any vendor
• Container and Kubernetes security
• SOC 2 or ISO 27001 exposure from the engineering side
• Experience in a small team where you owned something end to end