Operations

Devsecops Evangelist

Heirs Holdings·Lagos, nigeria·Full Time·Internship
OperationsFull TimeInternship
-

The Role

  • The DevSecOps Evangelist is the cultural and educational force behind this platform's engineering standards. Where the DevSecOps Engineers build and operate the pipelines, you make sure every engineer across every team understands, embraces, and actively applies the practices those pipelines enforce. You sit across all five delivery lanes Architect, Develop, Secure, Ship, and Support and your mandate is to make DevSecOps the instinct, not the instruction. This is a critical, cross-functional role for someone who is as technically credible as they are compelling.

What You'll Do

  • DevSecOps Culture & Strategy Own the platform's DevSecOps culture programme defining what engineering excellence looks like across security, quality, automation, and delivery speed, and building the strategy to embed it across every team. Work with the Platform Manager to align the culture programme with platform delivery goals and make DevSecOps the shared operating philosophy of the entire engineering organisation.
  • Education & Enablement Design and deliver a continuous engineering enablement programme including workshops, onboarding sessions, lunch-and-learns, and hands-on labs that brings every engineer on the platform up to and beyond the DevSecOps standard. Partner closely with the DevSecOps Engineers to translate technical pipeline controls into accessible, actionable learning. No engineer should ever cite lack of knowledge as the reason a standard was missed.
  • Standards Stewardship Own the platform's DevSecOps standards documentation maintaining it as a living, accessible, and authoritative reference for how engineering is done on this platform. Ensure documentation covers CI/CD pipeline usage, security gate requirements, IaC practices, container standards, secrets handling, and dev container setup. Make it clear, opinionated, and easy to follow.
  • Pipeline & Tooling Adoption Drive active adoption of the platform's CI/CD tooling, security gates, AI-powered code review and testing agents, and developer environment standards across all engineering teams and contributors. Identify adoption gaps early, work with the DevSecOps Engineers to remove friction, and track adoption rates to ensure no team is operating outside the standard.
  • Shift-Left Security Advocacy Champion the principle that security is everyone's responsibility and belongs at the beginning of every development conversation not the end. Run targeted security awareness initiatives across engineering teams. Work with the Platform Manager (Security) to translate security requirements into engineering habits, and ensure every contributor understands the security implications of the code they write.
  • DORA Metrics & Maturity Tracking Track, baseline, and report on DevSecOps adoption and engineering maturity across the platform using DORA metrics (deployment frequency, lead time, change failure rate, MTTR) and qualitative signals from team engagement. Identify teams and practices that need targeted support and use data to demonstrate the impact of the culture programme over time.
  • Community of Practice Build and run a DevSecOps community of practice across the engineering organisation creating the forums, rituals, and channels through which engineers share learnings, surface problems, celebrate wins, and continuously raise the standard together. Keep the community active, inclusive, and technically grounded.
  • Innovation & Emerging Practices Continuously track the evolving DevSecOps landscape including AI-assisted development tools, emerging pipeline security standards, supply chain frameworks, and industry best practices. Identify and pilot innovations that could meaningfully raise the platform's engineering standards, and build the case for adoption where the evidence supports it.
  • Cross-functional Influence Operate across all five delivery lanes Architect/Design, Develop, Secure, Ship, and Support building trust and credibility with every team on the platform. You are not a gatekeeper; you are a force multiplier. Your influence should make the teams around you faster, safer, and more confident in how they build.
  • Executive Reporting Report regularly to the Platform Manager on the state of DevSecOps adoption, culture programme progress, maturity trends, and areas of concern. Provide clear, evidence-based narratives that allow leadership to understand where the platform's engineering culture is strong and where focused investment is needed.

What We're Looking For

Must Have

  • 5+ years of experience in software engineering or DevSecOps, with a strong enough technical foundation to teach, guide, and credibly challenge engineers across architecture, cloud, pipelines, and security.
  • Proven experience driving engineering culture change in a large, complex organisation shifting mindsets, embedding new practices, and sustaining adoption beyond initial rollout.
  • Deep familiarity with CI/CD pipelines and DevSecOps tooling GitHub Actions, Azure DevOps Pipelines, GitLab CI, or Jenkins and the ability to explain them clearly to engineers at every level of experience.
  • Strong working knowledge of shift-left security principles and the tooling that enforces them SAST, DAST, SCA, secrets detection, container scanning (Trivy), and dependency vulnerability management (Snyk).
  • Excellent communication, facilitation, and teaching skills you can hold a room, run a workshop, write documentation that people actually read, and make complex technical concepts accessible without oversimplifying them.
  • Hands-on experience with Infrastructure as Code (Terraform, Ansible, Bash), containerisation (Docker), and cloud-native development practices you must understand what you are evangelising.

Nice to Have

  • Experience with DORA metrics, DevOps maturity models, or engineering effectiveness frameworks and a track record of using data to demonstrate cultural and process improvement.
  • Familiarity with AI-assisted development and testing tools including AI code review agents, AI-powered test generation, and their integration into CI/CD pipelines.
  • Public presence in the DevSecOps or engineering community conference speaking, technical writing, open-source contributions, or community leadership.
  • Experience in fintech, banking, or a regulated environment with an understanding of how compliance requirements shape engineering practice.
  • AWS and/or Microsoft Azure certification any track relevant to cloud-native development or DevOps.

Key skills

BA/BSc/HND
Apply Now

At a glance

Company

Heirs Holdings

Location

Lagos, nigeria

Employment

Full Time

Experience

Valid until

Not specified

Created

July 6, 2026

More opportunities

Similar roles you might like

Senior Devsecops Engineer

Heirs Insurance Ltd

Lagos, nigeria

full-time

The Role As a Senior DevSecOps Engineer, you are the builder and operator of the pipelines, tooling, and security controls that let every engineer on this platform ship fast and ship safely. You will design, implement, and own the CI/CD infrastructure, security gates, container build pipelines, and developer tooling that govern how code moves from a developer's workstation to production. On a platform handling the financial data of millions of Africans, the pipeline is a critical control surface, and you own it end to end. What You'll Do Ci/CD Pipeline Design & Ownership: Own the design, implementation, and ongoing operation of the platform's CI/CD infrastructure, ensuring every service, across every team, ships exclusively through automated, version-controlled pipelines. Build and maintain pipelines across the platform's approved CI/CD tooling, GitHub Actions, Azure DevOps Pipelines, GitLab CI, and Jenkins. No engineer has direct access to promote code to any environment manually. Every pipeline must be reproducible, auditable, and fast. Pipeline Quality Gates: Embed security, quality, and performance validation into every stage of the development lifecycle, enforcing mandatory, automated gates on the path to production. Implement and operate SAST, DAST, SCA, and secrets detection for security; automated test coverage thresholds, integration tests, and end-to-end test suites for quality; and load testing and performance benchmark gates to ensure no release degrades platform performance. Integrate AI-powered code review and testing agents into CI/CD pipelines, automating test generation, surfacing code quality issues early, and augmenting human review before code reaches a reviewer. No service may be promoted to staging or production without passing every gate. Work closely with the Platform Manager (Security) to define gate policies, manage exceptions, and continuously raise the bar. Container Build & Supply Chain Security: Own the platform's container build pipeline end to end, from base image governance to final image publication. Enforce the use of approved, minimal base images. Integrate container image scanning (Trivy) and dependency vulnerability scanning (Snyk) into every build. No container image reaches any environment without passing security scans. Maintain a software bill of materials (SBOM) for all platform services and ensure supply chain integrity is continuously monitored. Infrastructure as Code Pipeline Integration: Integrate all infrastructure provisioning workflows, Terraform, Ansible, and Bash, into version-controlled, automated pipelines. Enforce IaC security scanning and policy checks before any infrastructure change is applied. No cloud or network configuration may be provisioned outside of a pipeline-controlled workflow. Work with Cloud and Network Engineers to ensure infrastructure pipelines meet the same security and auditability standards as application pipelines. Environment Management & Dev Containers: Own the platform's environment strategy, ensuring dev, staging, and production are consistently defined, reproducible, and spun up on demand via IaC. Enforce the use of dev containers across all engineering teams, every developer works in a standardised, version-controlled development environment that mirrors production. No environment drift. No snowflake configurations. Secrets Management Integration: Integrate Azure Key Vault and AWS Secrets Manager, or equivalent secrets management platforms, into all CI/CD pipelines and application deployment workflows. Enforce secret rotation schedules. Ensure no secret, credential, API key, or certificate is ever hardcoded in application code, configuration files, container images, or pipeline definitions. Any violation must trigger an automated alert and mandatory rotation. Observability & DORA Metrics: Instrument all CI/CD pipelines with the metrics and tooling needed to track, baseline, and continuously improve the platform's engineering performance. Own the collection and reporting of DORA metrics, deployment frequency, lead time for changes, change failure rate, and mean time to recovery (MTTR). Surface these metrics to the Platform Manager in real time and use them to drive targeted pipeline improvements. Developer Experience & Standards: Make the right way the easy way. Own the developer tooling, onboarding documentation, and pipeline standards that define how engineers contribute to this platform. Reduce friction on the path to production without compromising security or quality. Work alongside the DevSecOps Evangelist to educate and embed DevSecOps best practices across engineering teams, supporting enablement sessions, flagging anti-patterns early, and ensuring every contributor understands and actively applies the platform's standards. Runtime Security: Implement and operate runtime security controls across the platform's containerised workloads, including Falco for runtime threat detection and container security policy enforcement. Ensure anomalous container behaviour triggers automated alerts routed to the SOC and Platform Manager (Security). Work with the security team to continuously tune detection rules and close runtime security gaps. Incident & Rollback Support: Maintain robust, tested rollback and re-deployment capabilities across all services and environments. Act as a key technical resource during platform incidents, diagnosing pipeline and deployment-layer failures, executing rollbacks, and restoring stability. Ensure all pipeline runbooks are documented, version-controlled, and regularly tested so that recovery from any deployment failure is fast, reliable, and well-practised. What We're Looking For Must Have 4+ years of hands-on DevSecOps or DevOps engineering experience, with proven ownership of CI/CD pipelines in a production, cloud-native environment. Expert-level experience with one or more of the platform's approved CI/CD tools, GitHub Actions, Azure DevOps Pipelines, GitLab CI, or Jenkins, and the ability to design, debug, and optimise complex pipeline workflows. Hands-on experience integrating security tooling into CI/CD pipelines, including SAST, DAST, SCA, and secrets detection. You understand what each gate is checking and why it matters. Strong container security knowledge, Docker image builds, base image governance, image scanning with Trivy or equivalent, and supply chain security with Snyk or equivalent. Solid Infrastructure as Code experience, Terraform, Ansible, and Bash, with a clear understanding that all infrastructure must be provisioned through automated, version-controlled pipelines, never manually. Hands-on experience with container orchestration platforms, Kubernetes on managed services (AKS, EKS) or serverless container platforms (Azure Container Apps, AWS App Runner / ECS Fargate). Working knowledge of secrets management platforms, Azure Key Vault, AWS Secrets Manager, or equivalent, and experience integrating them into CI/CD workflows. Nice to Have Experience with runtime security tooling, specifically Falco for container threat detection. Familiarity with DORA metrics tooling and experience using engineering performance data to drive pipeline improvement. Experience with serverless compute platforms, Azure Functions and/or AWS Lambda, for event-driven pipeline triggers or lightweight automation. AWS and/or Microsoft Azure certification, Developer, DevOps, or Solutions Architect tracks. Experience working in a fintech, banking, or regulated environment, with working knowledge of PCI DSS pipeline security requirements or CBN guidelines. Familiarity with software bill of materials (SBOM) tooling and supply chain security frameworks (e.g., SLSA, NIST SSDF).

3 months ago

Senior Devsecops Engineer

Heirs Holdings

Lagos, nigeria

full-time

The Role As a Senior DevSecOps Engineer, you are the builder and operator of the pipelines, tooling, and security controls that let every engineer on this platform ship fast and ship safely. You will design, implement, and own the CI/CD infrastructure, security gates, container build pipelines, and developer tooling that govern how code moves from a developer's workstation to production. On a platform handling the financial data of millions of Africans, the pipeline is a critical control surface and you own it end to end. What You'll Do CI/CD Pipeline Design & Ownership Own the design, implementation, and ongoing operation of the platform's CI/CD infrastructure ensuring every service, across every team, ships exclusively through automated, version-controlled pipelines. Build and maintain pipelines across the platform's approved CI/CD tooling GitHub Actions, Azure DevOps Pipelines, GitLab CI, and Jenkins. No engineer has direct access to promote code to any environment manually. Every pipeline must be reproducible, auditable, and fast. Pipeline Quality Gates Embed security, quality, and performance validation into every stage of the development lifecycle enforcing mandatory, automated gates on the path to production. Implement and operate SAST, DAST, SCA, and secrets detection for security; automated test coverage thresholds, integration tests, and end-to-end test suites for quality; and load testing and performance benchmark gates to ensure no release degrades platform performance. Integrate AI-powered code review and testing agents into CI/CD pipelines automating test generation, surfacing code quality issues early, and augmenting human review before code reaches a reviewer. No service may be promoted to staging or production without passing every gate. Work closely with the Platform Manager (Security) to define gate policies, manage exceptions, and continuously raise the bar. Container Build & Supply Chain Security Own the platform's container build pipeline end to end from base image governance to final image publication. Enforce the use of approved, minimal base images. Integrate container image scanning (Trivy) and dependency vulnerability scanning (Snyk) into every build. No container image reaches any environment without passing security scans. Maintain a software bill of materials (SBOM) for all platform services and ensure supply chain integrity is continuously monitored. Infrastructure as Code Pipeline Integration Integrate all infrastructure provisioning workflows Terraform, Ansible, and Bash into version-controlled, automated pipelines. Enforce IaC security scanning and policy checks before any infrastructure change is applied. No cloud or network configuration may be provisioned outside of a pipeline-controlled workflow. Work with Cloud and Network Engineers to ensure infrastructure pipelines meet the same security and auditability standards as application pipelines. Environment Management & Dev Containers Own the platform's environment strategy ensuring dev, staging, and production are consistently defined, reproducible, and spun up on demand via IaC. Enforce the use of dev containers across all engineering teams every developer works in a standardised, version-controlled development environment that mirrors production. No environment drift. No snowflake configurations. Secrets Management Integration Integrate Azure Key Vault and AWS Secrets Manager or equivalent secrets management platforms into all CI/CD pipelines and application deployment workflows. Enforce secret rotation schedules. Ensure no secret, credential, API key, or certificate is ever hardcoded in application code, configuration files, container images, or pipeline definitions. Any violation must trigger an automated alert and mandatory rotation. Observability & DORA Metrics Instrument all CI/CD pipelines with the metrics and tooling needed to track, baseline, and continuously improve the platform's engineering performance. Own the collection and reporting of DORA metrics deployment frequency, lead time for changes, change failure rate, and mean time to recovery (MTTR). Surface these metrics to the Platform Manager in real time and use them to drive targeted pipeline improvements. Developer Experience & Standards Make the right way the easy way. Own the developer tooling, onboarding documentation, and pipeline standards that define how engineers contribute to this platform. Reduce friction on the path to production without compromising security or quality. Work alongside the DevSecOps Evangelist to educate and embed DevSecOps best practices across engineering teams supporting enablement sessions, flagging anti-patterns early, and ensuring every contributor understands and actively applies the platform's standards. Runtime Security Implement and operate runtime security controls across the platform's containerised workloads including Falco for runtime threat detection and container security policy enforcement. Ensure anomalous container behaviour triggers automated alerts routed to the SOC and Platform Manager (Security). Work with the security team to continuously tune detection rules and close runtime security gaps. Incident & Rollback Support Maintain robust, tested rollback and re-deployment capabilities across all services and environments. Act as a key technical resource during platform incidents diagnosing pipeline and deployment-layer failures, executing rollbacks, and restoring stability. Ensure all pipeline runbooks are documented, version-controlled, and regularly tested so that recovery from any deployment failure is fast, reliable, and well-practised. What We're Looking For Must Have 4+ years of hands-on DevSecOps or DevOps engineering experience, with proven ownership of CI/CD pipelines in a production, cloud-native environment. Expert-level experience with one or more of the platform's approved CI/CD tools GitHub Actions, Azure DevOps Pipelines, GitLab CI, or Jenkins and the ability to design, debug, and optimise complex pipeline workflows. Hands-on experience integrating security tooling into CI/CD pipelines including SAST, DAST, SCA, and secrets detection. You understand what each gate is checking and why it matters. Strong container security knowledge Docker image builds, base image governance, image scanning with Trivy or equivalent, and supply chain security with Snyk or equivalent. Solid Infrastructure as Code experience Terraform, Ansible, and Bash with a clear understanding that all infrastructure must be provisioned through automated, version-controlled pipelines, never manually. Hands-on experience with container orchestration platforms Kubernetes on managed services (AKS, EKS) or serverless container platforms (Azure Container Apps, AWS App Runner / ECS Fargate). Working knowledge of secrets management platforms Azure Key Vault, AWS Secrets Manager, or equivalent and experience integrating them into CI/CD workflows. Nice to Have Experience with runtime security tooling specifically Falco for container threat detection. Familiarity with DORA metrics tooling and experience using engineering performance data to drive pipeline improvement. Experience with serverless compute platforms Azure Functions and/or AWS Lambda for event-driven pipeline triggers or lightweight automation. AWS and/or Microsoft Azure certification Developer, DevOps, or Solutions Architect tracks. Experience working in a fintech, banking, or regulated environment with working knowledge of PCI DSS pipeline security requirements or CBN guidelines. Familiarity with software bill of materials (SBOM) tooling and supply chain security frameworks (e.g., SLSA, NIST SSDF).

4 months ago