Senior DevSecOps & Cloud Security Engineer

Role Summary

Senior DevSecOps & Cloud Security Engineer is responsible for securing MPF’s applications, Azure cloud environments, development platforms and production services.

This is a hands-on technical role covering cloud and application security, identity and access management, vulnerability management, security monitoring, incident response and selected cloud-platform operations.

Key Responsibilities

Cloud and Platform Security

• Assess and improve the security posture of Microsoft Azure environments.

• Secure Azure App Service, Front Door, Key Vault, Storage, Redis, Service Bus, Azure SQL and related services.

• Review cloud networking, public exposure, access permissions and configuration risks.

• Configure and maintain DNS, subdomains, custom domains, SSL/TLS certificates and certificate renewals.

• Manage Azure Front Door routes, origins, health probes and related security configurations.

• Support Azure App Service configuration, deployment slots, scaling, health checks and application settings.

• Maintain security baselines, architecture diagrams and operational procedures.

Application and DevSecOps Security

• Integrate security controls into Azure DevOps, GitHub Actions and CI/CD pipelines.

• Implement code, dependency, vulnerability, secret and infrastructure scanning.

• Establish security and release-approval gates.

• Review application architecture, APIs, authentication, authorisation and data-protection controls.

• Coordinate penetration testing and track remediation actions.

• Work with engineering teams to promote secure coding and security-by-design practices.

Web and Edge Security

• Administer Cloudflare DNS, CDN, WAF, bot-management and rate-limiting controls.

• Monitor malicious traffic, automated attacks, credential abuse and suspicious activities.

• Review firewall rules, exclusions, false positives and authentication-route protections.

• Ensure security rules are tested, approved and supported by rollback procedures.

• Troubleshoot DNS, SSL/TLS, routing, origin connectivity and certificate issues.

Identity, Access and Vulnerability Management

• Manage privileged access across Azure, GitHub Enterprise, Azure DevOps, Cloudflare and production platforms.

• Conduct access reviews and enforce least-privilege principles.

• Coordinate user onboarding, role changes and timely leaver-access removal.

• Manage service accounts, certificates, secrets, tokens and credential-rotation procedures.

• Maintain a register of vulnerabilities and security findings.

• Prioritise and track remediation, patching and accepted risks to closure.

Security Monitoring and Incident Response

• Maintain security alerts, dashboards, detection rules and escalation procedures.

• Use Cloudflare, Azure Monitor, Application Insights, Log Analytics and KQL for investigations.

• Lead or support security-incident triage, containment, recovery and root-cause analysis.

• Preserve relevant logs and technical evidence.

• Coordinate response activities with engineering, infrastructure, Corporate IT and vendors.

• Participate in critical after-hours incident support when required.

Security Tool and Licence Administration

• Administer tools such as SonarCloud, GitHub Enterprise, Cloudflare, Azure security services and vulnerability-scanning platforms.

• Manage administrators, user access, integrations, support contacts and licences.

• Track subscription costs, usage, renewal dates and cancellation deadlines.

• Coordinate software renewals and purchase requirements with Finance and Procurement.

• Maintain primary and backup ownership for critical platforms.

Qualifications and Experience

• Degree or diploma in Cybersecurity, Computer Science, Information Technology or a related field.

• At least five years of experience in cybersecurity, cloud security, application security or DevSecOps.

• At least three years of hands-on experience with Microsoft Azure.

• Strong knowledge of cloud security, IAM, vulnerability management and application security.

• Experience with Cloudflare WAF, DNS, CDN, bot-management or equivalent technologies.

• Experience integrating security scanning into Azure DevOps or GitHub Actions.

• Familiarity with .NET applications, REST APIs and distributed architectures.

• Experience with Azure Monitor, Application Insights, Log Analytics and KQL.

• Knowledge of OWASP, API security and secure-development practices.

• Experience supporting security incidents and technical root-cause analysis.

• Strong troubleshooting, documentation and communication skills.

Preferred Experience and Certifications

• Experience with Azure Front Door, Key Vault, App Service, Redis, Service Bus and Azure SQL.

• Experience administering GitHub Enterprise and SonarCloud.

• Knowledge of Terraform, Bicep or equivalent infrastructure-as-code tools.

• AZ-500, SC-200, SC-300, Security+, CISSP or CCSP certification is an advantage.

• AZ-400 or AZ-104 certification is beneficial.