DevSecOps Engineer

About Axiler

Axiler (axiler.com) is a cybersecurity startup building security products that protect our customers’ infrastructure and applications. We ship both SaaS and on-prem deployment models — our software runs in our cloud and inside customer environments, including regulated and tightly controlled networks. When a security company ships software, the bar is higher: our customers are buying trust, and every release has to earn it

Why This Role Exists

A security company’s pipeline is part of its product.

Our customers don’t just run our software they audit it. They ask how we build, sign, scan, and ship it, and the honest answer needs to be airtight. Until now, CI/CD, deployment automation, and security gates have been built by engineers who also ship features. That model doesn’t scale, and it won’t survive a serious customer security review.

You will own the systems that build, secure, and deliver every Axiler product — from commit to SaaS deployment to an on-prem installer running in a customer’s restricted environment. You are the last checkpoint between “code merged” and “running in a customer’s network.” That authority is real, and we expect you to use it

About the Role

If your understanding of DevSecOps is “I add a linter and a Trivy scan to the pipeline,” this role is not for you.

We build and operate a multi-tenant SaaS platform with on-prem and hybrid delivery. Today we gap of a dedicated owner for CI/CD security, release engineering, and deployment observability. You will build this from the ground up: secure pipelines, supply-chain controls (SBOM, signing, provenance), secrets management, environment automation, monitoring and alerting that goes far beyond uptime checks, and the release machinery that lets us ship to both our cloud and customer premises with confidence.

This is a greenfield opportunity inside a real security company with real customers and real deployments in both models. You will design from first principles, make architectural decisions, set the standards that carry us through growth and customer audits, and be the person who says “not yet” when a release isn’t safe to ship.

What You Will Own

1. CI/CD Pipeline Security & Release Engineering You will design, build, and harden CI/CD pipelines for all Axiler products. This means secure build environments, artifact signing and provenance (Sigstore/Cosign, in-toto, or equivalent), SBOM generation and management, dependency and container scanning with enforced gates, and quality thresholds that actually block bad releases. Your goal is releases that are routine, low-risk, and provably secure for every product, every time.

2. SaaS & On-Prem Deployment Automation You will own deployment automation across both delivery models. For SaaS: progressive delivery (canary/ blue-green), automated rollbacks, environment promotion. For on-prem: versioned installers and upgrade paths that work in restricted customer environments, including limited-connectivity scenarios, with clear rollback and diagnostics. One product, two deployment worlds — you make both boring.

3. Supply Chain & Build Security You will reduce our supply-chain attack surface: hardened and minimal base images, pinned and verified dependencies, isolated build runners, least-privilege pipeline credentials, and short-lived secrets. You will define how third-party code enters our builds and what never does.

4. Secrets, Identity & Access You will implement and enforce secrets management (Vault or equivalent), RBAC, and least-privilege access across pipeline, cloud, and production systems. No long-lived credentials in CI. No shared admin accounts. Access is scoped, audited, and revocable.

5. Monitoring, Alerting & Incident Response You will build observability across pipelines and deployments we find out about problems from our systems, not from customers. You will define SLOs, own the on-call rotation for infrastructure and deployment incidents, and write runbooks so a 3am incident is a procedure, not a scramble. Security incidents in our build or delivery systems get the same rigor.

6. Compliance & Customer Trust You will drive SOC 2 / ISO 27001 readiness for everything in your domain controls implemented as code, evidence collected continuously, not assembled in a panic. You will own the technical answers in customer security reviews and audits of our SDLC and deployment practices. Compliance should be a byproduct of how we build, not a separate project.

7. Infrastructure as Code You will manage cloud and build infrastructure through code (Terraform/Pulumi) reproducible, re viewed, versioned. Console changes are a bug. You will balance security, cost, reliability, and developer experience, and be able to defend the trade-offs you make.

Values & Vibe (Who You Are)

You see a pipeline through the lens of what could compromise it, not just whether it passes. Supply chain attacks, poisoned dependencies, leaked credentials, tampered artifacts you assume these happen and build as if they will be attempted against us, because we’re a security company and they will be.

You bring order to unmanaged environments not by piling on tools, but through clarity, automation, and sane defaults. “It works on the release engineer’s machine” makes you physically uncomfortable. So does a pipeline nobody can explain.

You are hands-on: you write Terraform, debug a broken deploy at 2am, review a teammate’s pipeline config, and read CVEs for fun-adjacent reasons. But your job is building systems that make the secure path the easy path not personally catching every issue forever.

You are comfortable saying “no” when a release isn’t safe, even under deadline pressure and just as importantly, you make “yes” fast and well-lit so engineers route through your gates instead of around them.

The Mindset We Hire For

• Intensity & grit — you run toward hard problems and stay until they’re solved.
• Ambitious simplification — smart enough for complex systems, wise enough to ship the simplest safe solution.
• Ownership over tickets — you ship outcomes, not close tickets.
• AI readiness — you use modern tools to multiply output.
• Humility & collaboration — high-bandwidth communicator, mentor others, ego stays outside.

What Success Looks Like

• Releases are routine, security-gated, and fully automated — no heroics, no tribal knowledge.

• Every artifact we ship — SaaS or on-prem — is signed, scanned, and traceable back to source.

• Acustomer security review of our SDLC is a formality, not a fire drill.

• Secrets and access are managed, audited, and boring.

• Monitoring catches deployment and pipeline issues before customers do.

• On-prem upgrades are as uneventful as SaaS deploys.

• SOC2/ISO 27001 evidence generates itself from how we work.

• Incident response is documented, practiced, and fast.

• The CEO never wonders whether a release was safe to ship

Required

• 5–8 years in DevOps, SRE, Platform, or Security Engineering — you’ve built and run production CI/CD and deployment systems, not just used them.

• Deep CI/CD experience (GitHub Actions, GitLab CI, Jenkins, or similar) — you’ve designed pipelines from scratch, including security gates, not inherited someone else’s.

• Software supply-chain security — artifact signing, SBOMs, dependency/container scanning, hardened build environments. You know how builds get compromised and how to stop it.

• Infrastructure as Code (Terraform, Pulumi, or equivalent) — you manage infrastructure through code and code review, not consoles.

• Container orchestration in production (Kubernetes or equivalent) — deployment, scaling, security hardening.

• Strong security fundamentals — secrets management, IAM/RBAC, network security, encryp tion at rest and in transit, vulnerability management, incident response.

• Scripting and automation fluency (Python, Bash, Go, or similar) — you automate yourself out of repeated work.

• Observability tooling (Prometheus/Grafana, Datadog, or similar) — you’ve built alerting that pages for real problems, not noise.

• Strong written and spoken English — async communication, clear documentation, incident reports, and design docs.

• Startup or high-growth experience — ambiguity, limited resources, hard deadlines, and you still ship.

Strongly Preferred

• Experience shipping on-prem or customer-managed software — installers, upgrade paths, air-gapped or restricted environments.

• Background at a security company or building security products (AppSec, WAF, detection, or similar).

• Familiarity with compliance frameworks (SOC 2, ISO 27001) — controls as code, continuous evi dence collection.

• Experience with progressive delivery (canary, blue-green, feature flags) and automated rollback.

• Multi-tenant SaaS security experience.

• Supply-chain security tooling in production (Sigstore/Cosign, in-toto, SLSA, Syft/Grype, or simi lar).

Nice to Have

• Relevant certifications (CKA/CKS, CISSP, or equivalent).

• Penetration testing or security audit exposure.

• Experience hardening Linux systems and minimal container images.

• Cost optimization of cloud and CI infrastructure.

• Familiarity with our stack: Kubernetes, Terraform, GitHub Actions.

Send your CV: [email protected]

Subject: DevSecOps Engineer