This position is based in Johannesburg.
We’re recruiting for the role of DevSecOps Manager. This senior role drives secure, automated, and compliant cloud-native delivery while managing monitoring/alerting, penetration testing programmes, vulnerability management, and broader cybersecurity initiatives. The DevSecOps Manager will lead a team of DevSecOps Engineers, foster a “security by design” culture, and enable the business to innovate rapidly in a regulated South African and global context.
Duties and Responsibilities:
- Provisioning and managing cloud infrastructure as code using Terraform, Ansible and AWS CloudFormation across Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP)
- Implementing containerisation and orchestration using Docker, Kubernetes and Helm to maintain consistent environments
- Automating repetitive tasks, reducing operational toil and improving developer experience through self-service tools
- Collaborating with Software Developers, Quality Assurance (QA) and Security Teams to embed DevOps practices, including shift-left security and automated testing
- Performing root cause analysis on production issues, implementing fixes and driving continuous improvement
- Participating in on-call rotations and incident response activities
- Leading, mentoring and developing a high-performing team of DevOps, Site Reliability Engineering (SRE) and Security Engineers
- Mentoring Junior Engineers and promoting a culture of automation and shared ownership
- Championing DevSecOps practices and culture across Development, Operations, Security and Compliance Teams
- Defining and tracking key performance indicators (KPIs), including vulnerability remediation time, security gate pass rate, mean time to recovery (MTTR), deployment frequency and alert reduction
- Designing, implementing and governing secure Amazon Web Services (AWS) architectures, including multi-account landing zones through Control Tower, Virtual Private Clouds (VPCs), Elastic Kubernetes Service (EKS), Lambda and Relational Database Service (RDS), using Infrastructure as Code (IaC) tools such as Terraform, AWS CloudFormation and Cloud Development Kit (CDK)
- Enforcing least-privilege Identity and Access Management (IAM), encryption through Key Management Service (KMS), secrets management, network security and data sovereignty requirements for Protection of Personal Information Act (POPIA) compliance
- Leveraging Amazon Web Services (AWS) native services, including Amazon Inspector, GuardDuty, Security Hub, Config, IAM Access Analyzer and AWS Security Agent for automated security management
- Building and enhancing secure CI/CD pipelines using AWS CodePipeline and GitLab to automate testing, builds and deployments with security gates, including static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), Infrastructure as Code (IaC), secret scanning and container scanning
- Architecting comprehensive monitoring and alerting solutions using AWS CloudWatch, GuardDuty, X-Ray, EventBridge and Security Information and Event Management (SIEM) integrations
- Designing intelligent alerting processes with automated routing, escalation, noise reduction and rapid incident response capabilities to support Cybercrimes Act obligations
- Setting up monitoring, logging and alerting processes to maintain high availability and performance
- Ensuring 24/7 visibility into security posture, system performance and compliance status
- Leading and co-ordinating regular penetration testing activities
- Overseeing vulnerability management processes, including scanning, risk-based prioritisation, remediation tracking and exception management
- Conducting threat modelling, runtime protection, supply chain security, zero-trust implementation and incident response activities
- Ensuring appropriate and reasonable technical and organisational measures for POPIA Condition 7 Security Safeguards compliance, including encryption, access controls, logging and regular testing
- Supporting audits and evidence collection processes
- Collaborating on release management activities, including security go/no-go decisions
- Remaining current with Amazon Web Services (AWS) security updates, emerging threats and South African regulatory changes
- Driving maturity of DevSecOps practices and conducting regular AWS Well-Architected Framework reviews aligned to the Security Pillar
Minimum Requirements:
- Bachelor’s degree in Computer Science, IT, Cybersecurity or Engineering
- At least 8 to 10 years in DevOps, Cloud Engineering, or Cybersecurity
- At least 3 to 5 years experience in technical leadership or management roles
- Strong hands-on AWS experience
- Proven track record in regulated environments with POPIA/GDPR compliance
- AWS Certified Security Specialty or AWS Certified DevOps Engineer – Professional
- CISSP, CISM, CCSP, or CISA
- Proficiency with security tools (Inspector, GuardDuty, SAST/DAST like SonarQube, SIEM)
- Proficiency in at least one scripting language (Python, Bash, PowerShell)
- Strong experience with Linux, networking, and Git
- Hands-on expertise with CI/CD, IaC, Docker/Kubernetes, and at least one major cloud platform (AWS/Azure/GCP certifications preferred)
- Knowledge of enetration testing methodologies and vulnerability management
- Knowledge of monitoring, observability, and infrastructure security