Meaningful work,
meaningful life

We are seeking a Shift-Left DevOps Engineer with expertise in integrating and optimizing GitHub Advanced Security tools, including CodeQL and Dependabot, to create a seamless, secure, and efficient DevOps environment. This role focuses on embedding security early into the development lifecycle, enhancing developer productivity, and enabling proactive, automated dependency and vulnerability management within CI/CD pipelines. The ideal candidate will have a strong DevOps background, familiarity with secure coding practices, and a commitment to a shift-left approach, empowering development teams to deliver secure code faster and more efficiently.

Key Responsibilities

• Integrate GitHub Advanced Security Tools into Development Workflows:

  • Configure and manage GitHub Advanced Security tools, including Dependabot and CodeQL, as part of the CI/CD process to catch issues early.

  • Customize security alerts, rules, and dependency checks to provide developer-friendly feedback directly within PRs.

  • Work alongside DevOps and development teams to ensure security insights from GitHub Advanced Security are actionable and optimized for developer workflows within Github.

• Automate Dependency Management with Dependabot:

  • Set up Dependabot to manage and automatically update dependencies, ensuring security patches are applied efficiently and with minimal manual intervention.

  • Collaborate with developers to integrate Dependabot PRs into branch workflows (feature, development, and release branches) with appropriate approval gates.

  • Enable automated testing for Dependabot updates to validate compatibility with the codebase, reducing dependency-related risks.

• Implement and Enhance Shift-Left Practices in CI/CD:

  • Integrate CodeQL analysis and other automated security checks into CI/CD pipelines for real-time feedback on code vulnerabilities and potential improvements.

  • Develop processes to ensure that security checks are embedded as early as possible in the development pipeline, providing rapid feedback to developers.

  • Create workflows that allow low-risk updates (such as minor dependency upgrades) to merge automatically when all tests pass, speeding up development cycles.

• Optimize Developer Experience with Automation and Tooling:

  • Build and maintain scripts, configurations, and dashboards that allow developers to self-manage security findings and track dependency health.

  • Continuously improve feedback loops to reduce false positives, ensure clear remediation steps, and increase developer productivity.

  • Design notifications and automated reminders for developers to address dependency or security issues within their PRs and feature branches.

• Support Developer Enablement and Education:

  • Provide support and training to developers on best practices for using GitHub Advanced Security, Dependabot, and CodeQL within their workflows.

  • Host sessions on secure coding and using automation tools to build secure applications, encouraging a culture of proactive security in development.

  • Develop and share documentation that simplifies the use of security tools, helping developers understand dependency and vulnerability management basics.

• Collaborate on CI/CD Optimization and Automation:

  • Work with DevOps and Engineering teams to optimize CI/CD processes, improving build speed, testing reliability, and deployment efficiency.

  • Set up monitoring and automated reporting for key metrics, such as dependency update success rates, time-to-fix vulnerabilities, and code quality trends.

  • Identify and implement automation opportunities to further streamline code quality and dependency management across development cycles.

Qualifications

• Technical Expertise:

  • Strong experience in DevOps, particularly with GitHub Advanced Security features like Dependabot and CodeQL, and hands-on experience integrating these tools into CI/CD pipelines.

  • Proficiency in scripting (e.g., Python, Bash) and automation tools to support continuous improvement in the CI/CD and development environments.

  • Knowledge of DevOps methodologies and best practices, particularly around automating testing, code quality, and dependency management.

• Experience:

  • 5+ years in DevOps, SRE, or similar roles with experience in development pipelines and automation.

  • Proven experience in managing dependencies, security updates, and automated PRs within GitHub or similar version control systems.

  • Strong understanding of CI/CD practices, with experience in streamlining workflows for developer efficiency and productivity.

• Soft Skills:

  • Excellent communication skills to collaborate effectively with development, DevOps, and QA teams.

  • Ability to advocate for and drive shift-left practices, enabling teams to adopt security and quality checks early in the development lifecycle.

  • Problem-solving skills with a focus on creating scalable, maintainable solutions that support a proactive DevOps environment.

Preferred Qualifications

• Certifications: Relevant DevOps or cloud certifications such as AWS DevOps, CKA (Certified Kubernetes Administrator), or similar.

• Additional Tools: Familiarity with other DevOps and automation tools, such as Jenkins, Terraform, Docker, and Kubernetes.