Senior DevSecOps Engineer

Konecta appears to be involved in artificial intelligence and software development, likely operating in the tech sector.

Senior DevSecOps Engineer **Level:** Senior (7+ years) **Location:** Konecta MEA HQ in Cairo (Hyprid Model), with travel to client locations as required **Engagement:** Client-facing, embedded with Customer delivery teams --- ## Role Summary We want to hire a Senior DevSecOps Engineer to design, build and operate end-to-end delivery pipelines for one of our our Customer engagement. This is not a heads-down build role. It is a client-facing role, which requires you to walk senior technical and non-technical stakeholders through what you have built, and defend your design decisions against industry best practice. The successful candidate combines deep hands-on capability — GitLab CI/CD, Kubernetes, containerisation, security-in-pipeline — with the communication skill to explain *why* an implementation looks the way it does, in clear, confident English, to an audience that may not share your technical depth. --- ## What You'll Do ### Pipeline engineering (GitLab CI/CD) - Design, build and maintain GitLab CI/CD pipelines covering the full path to production: build → test → scan → package → deploy → verify. - Author reusable pipeline components, templates and shared libraries so patterns scale across teams rather than being rebuilt per repo. - Manage GitLab Runners (Kubernetes executor), caching, artefact strategy and pipeline performance — keep feedback loops short. - Implement quality and security gates: SAST, DAST, dependency/SCA scanning, container image scanning, secret detection, licence compliance. ### Kubernetes & deployment - Own deployment into Kubernetes clusters end to end — not just handing off an artefact. - Package and deploy workloads using Helm and/or Kustomize; implement GitOps delivery (ArgoCD or Flux) where appropriate. - Configure the operational surface of a workload properly: resource requests/limits, probes, HPA, PodDisruptionBudgets, RBAC, NetworkPolicies, securityContext and Pod Security Standards. - Implement progressive delivery — blue/green, canary, rollback strategy — and be able to explain the trade-offs of each. - Troubleshoot cluster and workload issues: CrashLoopBackOff, scheduling failures, image pull problems, resource pressure, ingress/DNS/service-mesh issues. ### Containerisation - Build secure, efficient container images: multi-stage builds, minimal/distroless base images, non-root users, correct layer caching, small attack surface. - Establish and enforce image standards — base image governance, tagging and versioning strategy, registry hygiene, vulnerability remediation SLAs. - Generate and manage SBOMs; drive image signing and provenance (Cosign / Sigstore, SLSA-aligned) where the client requires supply-chain assurance. ### Security integrated into delivery - Shift security left: make the secure path the easy path, embedded in the pipeline rather than bolted on at the end. - Implement secrets management (HashiCorp Vault, External Secrets Operator, or cloud-native equivalents) — no secrets in repos, images or CI variables where avoidable. - Apply policy-as-code (OPA/Gatekeeper, Kyverno) and infrastructure scanning (Checkov, Trivy, tfsec). - Work within regulated-industry controls: separation of duties, auditability, change evidence, least privilege. ### Client-facing communication *(core to this role)* - Present designs, options and trade-offs to all stakeholders — engineers, architects, security teams and management — with clarity and confidence. - Justify every implementation decision against recognised best practice: explain what you chose, what you rejected, and why. - Run walkthroughs, demos, working sessions and knowledge-transfer with client teams. - Translate between technical detail and business impact — cost, risk, delivery velocity, compliance posture. - Handle challenge and pushback constructively; adapt the design when the client raises a valid constraint, and hold the line with evidence when they don't. ### Documentation & delivery governance - Produce and maintain high-quality documentation in Confluence: architecture decision records (ADRs), runbooks, onboarding guides, pipeline reference docs, troubleshooting playbooks. - Treat documentation as a first-class deliverable — accurate, current, and written for the reader who wasn't in the room. - Manage work transparently in Jira: well-formed stories, clear acceptance criteria, accurate status, useful updates for stakeholders. - Contribute to sprint ceremonies, estimation and delivery reporting. ## Essential Requirements **Experience** - 6–10 years in DevOps / Platform / DevSecOps engineering, with meaningful time spent owning production delivery pipelines. - Demonstrable experience in a client-facing or consulting-style role. **Technical** - **GitLab CI/CD** — expert level. Pipeline architecture, templates, runners, optimisation. (Strong Jenkins/GitHub Actions/Azure DevOps background with willingness to go deep on GitLab may be considered.) - **Kubernetes** — strong practical depth, beyond "I've applied a manifest". Comfortable debugging a live cluster. - **Containerisation** — Docker/OCI, image security and optimisation, registry management. - **Helm** and templating/packaging of workloads. - **Infrastructure as Code** — Terraform (or equivalent). - **Scripting** — Bash plus one of Python / Go. - **Git** — branching strategy, merge/release workflows, code review discipline. - **Cloud** — hands-on with at least one major provider (AWS / Azure / GCP), including IAM, networking and managed Kubernetes. - **Security tooling in CI** — SAST/DAST/SCA, container scanning, secrets management. **Communication** - Excellent spoken and written English — this is a hard requirement, not a nice-to-have. - Able to present to and hold a room with senior stakeholders. - Structured, evidence-based reasoning; can articulate the rationale behind a design and defend it under scrutiny. **Ways of working** - Confluence and Jira as daily tools, used well. - Self-directed, comfortable with remote-first delivery and asynchronous collaboration. - Willing and able to travel to client locations when required. ## Desirable - **Agentic / AI-assisted development** — practical use of GitHub Copilot CLI, Claude Code or similar agentic tooling to accelerate engineering work, with sound judgement about where AI assistance is and isn't appropriate. - GitOps at scale — ArgoCD or Flux. - Observability — Prometheus, Grafana, OpenTelemetry, ELK/Loki; defining SLOs and meaningful alerting. - Service mesh (Istio, Linkerd) and advanced ingress/traffic management. - Financial services, capital markets or other regulated-industry experience; familiarity with the control expectations that come with it. - Supply-chain security — SLSA, SBOM, artefact signing and provenance. - Certifications — CKA / CKAD / CKS, cloud architect or security certifications, GitLab certifications. - Experience running platform enablement or internal developer platform (IDP) initiatives — Backstage or similar. - FinOps awareness — cost-conscious pipeline and cluster design. - DR/BCP, backup and restore design for stateful workloads on Kubernetes Show more