Senior DevSecOps Engineer

Overview

Arbor Education is hiring a Senior DevSecOps Engineer to join its DevSecOps team and help secure the resilience, integrity and performance of the Arbor platform as it scales, including the AI-enabled systems and developer tooling used to build and operate it.

What you'll do

• Collaborate with stakeholders to pinpoint security enhancements across platform architecture and infrastructure, devising and executing strategic plans for implementation
• Work closely with the Platform team to embed robust security processes, controls and tooling across all system components
• Threat model new and existing systems, including AI/LLM-enabled features and agentic workflows, and translate findings into prioritised, actionable work
• Strengthen the software supply chain: dependency and base-image hygiene, SBOM generation, artefact signing and provenance, and pinning of third-party actions and packages
• Secure the use of AI across the SDLC, ensuring agentic coding tools, assistants and MCP integrations operate within safe, well-scoped and auditable boundaries
• Contribute to the evolution of deployment frameworks, emphasising security, deployment speed and system stability
• Elevate platform security through strong secrets management and the safe handling of sensitive information
• Play an active role in incident response, resolution and blameless post-mortems, facilitating continuous improvement
• Participate in knowledge-sharing initiatives, including tech-talks and team-based learning sessions
• Maintain meticulous, current documentation, including playbooks, runbooks and comprehensive systems documentation

What you'll need

• Extensive experience in cyber security and associated engineering practices
• Vulnerability management and remediation at scale
• Proven track record in DevOps / DevSecOps engineering within large-scale platforms
• Proficiency in distributed cloud systems, particularly Amazon Web Services
• Expertise in Infrastructure as Code (IaC) tooling such as Terraform and CloudFormation
• Experience with languages such as PHP, Bash or Python
• Experience with Docker and containerisation, with a working understanding of container and runtime security
• Software supply-chain security: SBOMs, dependency scanning, and artefact signing / provenance (e.g. SLSA, Sigstore)
• Secrets management and detection (e.g. Vault, cloud-native secret stores, secret-scanning in CI)
• Security tooling across the SDLC: SAST, DAST, SCA, IaC scanning, and container scanning (e.g. Snyk, Trivy)
• Policy-as-code and guardrails (e.g. OPA / Conftest), with an identity-centric / zero-trust approach to access
• Familiarity with monitoring and detection tooling such as DataDog, Prometheus, or similar platforms
• A proactive problem-solving attitude coupled with strong teamwork and communication skills
• Exceptional proficiency in written and spoken English
• Practical understanding of AI/LLM security risks and their mitigations, e.g. prompt injection, jailbreaks, insecure output handling, sensitive-data leakage and excessive agency (aligned to the OWASP Top 10 for LLM Applications)
• Experience securing AI-assisted and agentic development tooling: scoping permissions, sandboxing, logging and audit, and preventing secret or data exfiltration through AI agents and MCP servers
• Familiarity with AI threat modelling and adversarial techniques (e.g. MITRE ATLAS) and with conducting or supporting AI-aware red teaming
• Awareness of AI governance and assurance frameworks (e.g. NIST AI RMF, ISO/IEC 42001) and how they intersect with data-protection obligations for a multi-tenant platform handling children's data
• Confident, responsible use of AI tooling to accelerate security work (triage, detection engineering, code review, documentation) while accounting for its limitations

Nice to have

• Past experience with enterprise solutions running at scale
• Familiarity with kanban and agile development processes
• Familiarity with software best practices such as Refactoring, Clean Code, Domain-Driven Design, Test-Driven Development, etc.
• Experience with compliance frameworks relevant to EdTech (e.g. NIST CSF, ISO 27001, SOC 2, UK GDPR)
• Relevant certifications (e.g. AWS Security Specialty, OSCP, or AI security / governance credentials)

Details

• Location: Remote
• Salary: £75,000 - £85,000
• Visa sponsorship is not available at this time