Expert DevSecOps Engineer (Software Development Security)

About the role

Roche is looking for an Expert DevSecOps Engineer, acting as a Software Development Security Expert, based in Madrid. The role sits at the intersection of software and security engineering: designing robust software development security frameworks, handling ambiguous security and compliance requirements, managing complex stakeholder landscapes and mentoring junior engineers. It works closely with the area architect on the long-term architecture of software engineering security solutions.

The position joins the Embedded Security & Testing Team within Engineering Excellence & Experience (E3), which integrates testing and security throughout the software development lifecycle and provides access to automated, composable infrastructure via Infrastructure as Code and APIs, on-premises and in the public cloud.

Key responsibilities

• Provide expert-level leadership and strategic guidance in DevSecOps, covering threat modelling, code quality, SAST, secret scanning, software composition analysis, IaC scanning, license compliance, dependency management, container image scanning, API security and container runtime scanning.
• Help define software security best practices, keeping them consistent, traceable and aligned with enterprise standards.
• Lead DevSecOps work on strategic activities and guide less experienced colleagues.
• Analyse complex business problems, define the problem space and drive root cause analysis across organisational boundaries.
• Build strong relationships with key stakeholders, influence business decisions and act as a trusted advisor to leadership.
• Evaluate strategic options through risk assessment and value analysis, recommend technology solutions and mentor colleagues, including leading Communities of Practice.
• Ensure strict security compliance does not slow down developers.

Required profile

• Bachelor's or Master's degree in Computer Science, Software Engineering or a related field, or equivalent practical experience.
• Minimum of 8-10+ years of progressive experience, including 3+ years specialising in building DevSecOps frameworks from scratch.
• Hands-on, tools-agnostic technical expert in DevSecOps enablement tools used by product and application teams across the SDLC.
• Experience designing automated security guardrails (SAST, SCA, container scanning) into DevOps workflows and using self-service DevOps platforms with security templates.
• Solid understanding of supply chain security for software packages, libraries and container images.
• Advanced analytical thinking, ability to navigate ambiguity and strong strategic influencing skills.

Required skills

• DevSecOps enablement tools such as SonarQube, GHAS, Sysdig, Snyk, IriusRisk, JFrog Xray and NowSecure.
• SAST, SCA, container image scanning and IaC scanning.
• Infrastructure as Code and self-service DevOps platforms.