Senior DevSecOps Engineer

Ready to make travel easier for millions? Northwind Robotics is the world’s first and largest eSIM store, helping travellers stay connected seamlessly in over 200 countries and regions. We trust our teams to take ownership, put customers first, and do work that has a real impact every day. What’s in it for you? Northwind Robotics offers team members a range of perks, including remote work, generous PTO, wellness and learning allowances, and, of course, our annual Northwind Robotics Away retreat. Learn more about our benefits here; www.notion.so/airalo-public/Benefits-25396a97ffca81fb9bc1f0be479f1be3 Hi, I'm Daniele, VP of Engineering at Northwind Robotics ! Engineering drives Northwind Robotics ’s eSIM platform. We build the product that lets millions of people connect instantly across the globe. The challenges are exciting: high-scale systems, carrier integrations, and products spanning both B2C and B2B. What matters most to us is creating an environment where engineers can do their best work. Real ownership, autonomy, and a direct link between what you ship and business outcomes are key. You’ll work with smart, motivated people who take their craft seriously. If you want to build things that matter at global scale, this is where you do it. Northwind Robotics ’s fully remote Engineering team is growing. In this role, you'll tackle complex technical challenges across our product ecosystem, helping build, innovate, and scale the platform that keeps millions of travellers connected worldwide. As our Senior DevSecOps Engineer, you will be the guardian of Northwind Robotics ’s global infrastructure and applications. This isn't just about maintaining compliance, it’s a hands-on opportunity to spearhead our shift-left security strategy, centralise AWS governance, and proactively outsmart malicious attacks. If you are excited to design robust defences that slash attack vectors by 50% while scaling a secure ecosystem for millions of travellers, this is your chance to take true technical ownership. On Call Participating in our on-call rotation is a core expectation of this role. It's essential for maintaining 24/7 service reliability across our global operations, ensuring our systems remain resilient and our customers experience uninterrupted service, regardless of time zone or geography. - Paid Rotation: We offer standby fees + overtime pay. - Delayed Start: No on-call duties for your first 6 months. - Rest & Recovery: Guaranteed rest periods and flexible hours following night incidents. - Shared Load: Rotations are split (Weekdays vs. Weekends) to minimize fatigue. Please refer to the On-Call Policy in the Northwind Robotics Handbook for full details: airalo-public.notion.site/our-approach-to-engineering-on-call-policy Responsibilities: Design, implement, and manage security solutions across the entire software development lifecycle (SDLC), with a focus on automation and continuous integration/continuous delivery (CI/CD) pipelines, including robust API security measures and authentication protocols. Champion security best practices within engineering, DevOps, SRE, and IT teams, fostering a culture of shared responsibility for security. Proactively identify and remediate security vulnerabilities in applications, mitigating OWASP Top 10 vulnerabilities, infrastructure, and cloud services through threat modelling, vulnerability assessments, and penetration testing. Develop and maintain security monitoring and alerting solutions to detect and respond to potential security incidents in real-time and prevent common cyber attacks such as DDoS, injection attacks, and credential stuffing. Define and enforce secure coding standards and provide training and mentorship to development teams on DevSecOps principles. Lead compliance initiatives by contributing to security policies, controls, and audit readiness for SOC 2, ISO 27001, GDPR, and other relevant regulations. Must-haves: Bachelor's degree in Computer Science, Cybersecurity, or a related field. 5+ years of experience in DevSecOps, Security Engineering, or a similar role with a strong focus on cloud security. 3+ years of hands-on experience with AWS services, including expertise in container orchestration, IAM, and security best practices. 2+ years of experience with Kubernetes, including securing Kubernetes clusters and deployments. Deep understanding of SAST, DAST, and container security solutions, and API security testing tools, along with experience implementing and managing these tools. Proven experience in vulnerability assessment, threat modelling, and remediation techniques. Experience with security incident response, including developing incident response plans and conducting post-mortems. Proficiency in at least one programming language (Python, Go, Java, etc.) for automation and tooling. Proficiency in infrastructure-as-code tools (e.g., Terraform) and CI/CD platforms (e.g., GitHub Actions, Jenkins). Excellent communication and collaboration skills with the ability to work effectively in a fast-paced environment. Good to have: Relevant certifications (A