Senior DevSecOps Engineer
*Level:* Senior (7+ years)
*Location:* Konecta MEA HQ in Cairo (Hyprid Model), with travel to client locations as required
*Engagement:* Client-facing, embedded with Customer delivery teams
## Role Summary
We want to hire a Senior DevSecOps Engineer to design, build and operate end-to-end delivery pipelines for one of our our Customer engagement. This is not a heads-down build role. It is a client-facing role, which requires you to walk senior technical and non-technical stakeholders through what you have built, and defend your design decisions against industry best practice.
The successful candidate combines deep hands-on capability — GitLab CI/CD, Kubernetes, containerisation, security-in-pipeline — with the communication skill to explain why an implementation looks the way it does, in clear, confident English, to an audience that may not share your technical depth.
## What You'll Do
### Pipeline engineering (GitLab CI/CD)
Design, build and maintain GitLab CI/CD pipelines covering the full path to production: build → test → scan → package → deploy → verify.
Author reusable pipeline components, templates and shared libraries so patterns scale across teams rather than being rebuilt per repo.
Manage GitLab Runners (Kubernetes executor), caching, artefact strategy and pipeline performance — keep feedback loops short.
Implement quality and security gates: SAST, DAST, dependency/SCA scanning, container image scanning, secret detection, licence compliance.
### Kubernetes & deployment
Own deployment into Kubernetes clusters end to end — not just handing off an artefact.
Package and deploy workloads using Helm and/or Kustomize; implement GitOps delivery (ArgoCD or Flux) where appropriate.
Configure the operational surface of a workload properly: resource requests/limits, probes, HPA, PodDisruptionBudgets, RBAC, NetworkPolicies, securityContext and Pod Security Standards.
Implement progressive delivery — blue/green, canary, rollback strategy — and be able to explain the trade-offs of each.
Troubleshoot cluster and workload issues: CrashLoopBackOff, scheduling failures, image pull problems, resource pressure, ingress/DNS/service-mesh issues.
### Containerisation
Build secure, efficient container images: multi-stage builds, minimal/distroless base images, non-root users, correct layer caching, small attack surface.
Establish and enforce image standards — base image governance, tagging and versioning strategy, registry hygiene, vulnerability remediation SLAs.
Generate and manage SBOMs; drive image signing and provenance (Cosign / Sigstore, SLSA-aligned) where the client requires supply-chain assurance.
### Security integrated into delivery
Shift security left: make the secure path the easy path, embedded in the pipeline rather than bolted on at the end.
Implement secrets management (HashiCorp Vault, External Secrets Operator, or cloud-native equivalents) — no secrets in repos, images or CI variables where avoidable.
Apply policy-as-code (OPA/Gatekeeper, Kyverno) and infrastructure scanning (Checkov, Trivy, tfsec).
Work within regulated-industry controls: separation of duties, auditability, change evidence, least privilege.
### Client-facing communication (core to this role)
Present designs, options and trade-offs to all stakeholders — engineers, architects, security teams and management — with clarity and confidence.
Justify every implementation decision against recognised best practice: explain what you chose, what you rejected, and why.
Run walkthroughs, demos, working sessions and knowledge-transfer with client teams.
Translate between technical detail and business impact — cost, risk, delivery velocity, compliance posture.
Handle challenge and pushback constructively; adapt the design when the client raises a valid constraint, and hold the line with evidence when they don't.
### Documentation & delivery governance
Produce and maintain high-quality documentation in Confluence: architecture decision records (ADRs), runbooks, onboarding guides, pipeline reference docs, troubleshooting playbooks.
Treat documentation as a first-class deliverable — accurate, current, and written for the reader who wasn't in the room.
Manage work transparently in Jira: well-formed stories, clear acceptance criteria, accurate status, useful updates for stakeholders.
Contribute to sprint ceremonies, estimation and delivery reporting.
## Essential Requirements
*Experience*
6–10 years in DevOps / Platform / DevSecOps engineering, with meaningful time spent owning production delivery pipelines.
Demonstrable experience in a client-facing or consulting-style role.
*Technical*
*GitLab CI/CD* — expert level. Pipeline architecture, templates, runners, optimisation. (Strong Jenkins/GitHub Actions/Azure DevOps background with willingness to go deep on GitLab may be considered.)
*Kubernetes* — strong practical depth, beyond "I've applied a manifest". Comfortable debugging a live cluster.
*Containerisation* — Docker/OCI, image security and optimisation, registry management.
*Helm* and templating/packaging of workloads.
*Infrastructure as Code* — Terraform (or equivalent).
*Scripting* — Bash plus one of Python / Go.
*Git* — branching strategy, merge/release workflows, code review discipline.
*Cloud* — hands-on with at least one major provider (AWS / Azure / GCP), including IAM, networking and managed Kubernetes.
*Security tooling in CI* — SAST/DAST/SCA, container scanning, secrets management.
*Communication*
Excellent spoken and written English — this is a hard requirement, not a nice-to-have.
Able to present to and hold a room with senior stakeholders.
Structured, evidence-based reasoning; can articulate the rationale behind a design and defend it under scrutiny.
*Ways of working*
Confluence and Jira as daily tools, used well.
Self-directed, comfortable with remote-first delivery and asynchronous collaboration.
Willing and able to travel to client locations when required.
## Desirable
*Agentic / AI-assisted development* — practical use of GitHub Copilot CLI, Claude Code or similar agentic tooling to accelerate engineering work, with sound judgement about where AI assistance is and isn't appropriate.
GitOps at scale — ArgoCD or Flux.
Observability — Prometheus, Grafana, OpenTelemetry, ELK/Loki; defining SLOs and meaningful alerting.
Service mesh (Istio, Linkerd) and advanced ingress/traffic management.
Financial services, capital markets or other regulated-industry experience; familiarity with the control expectations that come with it.
Supply-chain security — SLSA, SBOM, artefact signing and provenance.
Certifications — CKA / CKAD / CKS, cloud architect or security certifications, GitLab certifications.
Experience running platform enablement or internal developer platform (IDP) initiatives — Backstage or similar.
FinOps awareness — cost-conscious pipeline and cluster design.
DR/BCP, backup and restore design for stateful workloads on Kubernetes.
