DevSecOps Engineer

Responsibilities

• Run the platform with the team: Azure, AKS, deployments, upgrades, incident response and a share of on-call once you know the systems.
• Build and operate the infrastructure the migration needs: environments, CI/CD pipelines on Azure DevOps, infrastructure as code, monitoring and alerting that people act on.
• Own the external attack surface. Build and keep an inventory of every internet-facing asset with a named owner, run continuous outside-in monitoring, and close exposures fast.
• Build security into the delivery pipeline on Azure DevOps and Kubernetes: code, dependency, secrets, container and infrastructure-as-code scanning, with gates the team accepts because you introduced them together.
• Set and hold the Azure and Microsoft 365 security baseline: identity and access, MFA, cloud posture, Defender, and a written access process so access requests take hours.
• Run vulnerability management as a process, from customer finding or scanner result to fix and verified closure, and keep the evidence ISO 27001 asks for.
• Carry the technical controls of the ISO 27001 programme together with our compliance lead. Customer security questionnaires and audits run through the compliance lead and platform; you own the technical answers, keep them current, and join the call when a customer digs deeper.

• Platform operations, the migration and the security baseline run in parallel. You do all three, and you decide the order each week.
• Enterprise and bank customers audit their suppliers and expect answers in days. You are the person who answers.
• The list of things you could do is longer than one person can carry. Choosing what comes first, and saying what waits, is part of the job.
• Small team. Everything you build has to work when you are not there.

Requirements

• 5+ years in platform/DevOps engineering, with hands-on Azure and Kubernetes in production: you have built clusters, pipelines and environments, run upgrades and carried on-call. Security engineering on top of that, owned rather than assisted, is what makes you a fit for this role.
• You have carried the technical side of ISO 27001 (or an equivalent framework) once already, or you have run vulnerability management end to end: finding, fix, verification, evidence an auditor accepts.
• You know the tooling by category rather than by logo: external attack surface monitoring, DAST, SAST, SCA, secrets and container scanning, cloud posture. You can pick the cheap option when it does the job and explain why.
• You script and automate by default. Bash, PowerShell or Python, infrastructure as code, and you treat a manual check as a bug.
• You write things down and can sit across from a customer’s security team or an auditor and answer plainly.
• Fluent English, Estonian or German is a plus.

Benefits

• You build the security practice from the ground up, with leadership backing and a customer base that is asking for it. What you set up in year one is what the certification runs on in year two.
• Headquarters is Tallinn, Estonia, and that is where most of the team sits. Remote from anywhere in the EU works for the right candidate. Moderate travel to Tallinn.
• A small, senior team. Decisions get made quickly and you are close to leadership.
• A product used by thousands of B2B buyers across Europe, with a broad supplier network behind every order.