Elite Devsecops Engineer

At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.
The PositionAs an Expert DevSecOps Engineer, acting as a Software Development Security Expert, you will sit at the intersection of software and security engineering. You are accountable for designing robust software development security frameworks, handling ambiguous security and compliance requirements, managing complex stakeholder landscapes, and mentoring junior engineers. You will also collaborate with the area architect in defining the long-term architecture for software engineering security solutions.
Description of the area:Engineering Excellence & Experience (E3) enables engineers to explore, plan, design, code, build, test, and deploy software packages in a reliable, secure, automated, and consistent manner across our different business areas. This includes providing facilitated access to automated, composable infrastructure consumable through Infrastructure as Code (IaC) and APIs, both on-premises and in the public cloud.
Within E3, you will join the Embedded Security & Testing Team, which champions the integration of testing and security concepts throughout the software development lifecycle. Specifically, the Code Quality, Security, and Testing Engineering team combines best practices and modern solutions to ensure that all code generated is secure and of the highest quality. The team provides a range of DevSecOps components fit for diverse technical complexities, delivers Proofs of Concept (PoCs), and supports internal adoption both during and after implementation.
Job

Responsibilities:
Scope:Provides expert-level leadership and strategic guidance in DevSecOps area, including Threat Modelling, Code Quality, SAST, Secret Scanning, Software Composition Analysis, IaC Scanning, License Compliance, Dependency Management, Container Image Scanning, API Security and Container Runtime ScannerParticipate in the definition of Software Security best practices, ensuring consistency, traceability, and alignment with enterprise standardsLeads DevSecOps efforts on strategic activities and provides guidance to less experienced membersProblem Solving:Leads the analysis of complex and strategic business problems, defining the problem space and driving comprehensive root cause analysis that may span organizational boundariesWorks on unusually complex problems, provides highly innovative solutions, and applies expert-level analytical and logical reasoning to proactively identify strategic opportunities and risksStakeholder Management & Strategic Influence:Builds and maintains strong relationships with key stakeholders and cultivates collaboration across the organizationElicits and analyzes complex stakeholder needs with expertise, and influences business stakeholders to inform and make the right decisionsShapes strategy as a trusted advisor to leadership, acting as an influential partner and organizational trust builderRecommends and guides the implementation of optimal strategies, transitions, and future states, fostering a culture of strategic innovation and continuous improvement within their product line or domainLeadership, Accountability & Mentorship:Evaluates strategic solution alternatives through rigorous risk assessment and value analysis, ensuring key initiatives align with overall organizational objectives, and recommends optimal technology solutions to drive business transformationIs accountable for deliverables on significant projects, ensuring alignment with strategic objectives, defining strategic solution scope, and managing complexityMentors colleagues, helps others develop expertise and skills, and provides guidance to other ExpertsActively contributes to organizational development, including showing leadership in Communities of Practice (CoPs)Understands and balances strict security compliances without slowing down developersQualifications &

Experience:
Required Technical

Experience:

Education:
Bachelor’s or Master’s degree in Computer Science, Software Engineering, or a related technical field (or equivalent practical experience)DevSecOps Expertise: Minimum of 8-10+ years of progressive experience, including 3+ years of specialization in building DevSecOps frameworks from scratchBe a hands-on tools agnostic technical expert on the DevSecOps Enablement tools to support Product and Application teams in deploying and using DevSecOps Enablement tooling across SDLC, including but not limited to: SonarQube, GHAS, Sysdig, Snyk, IriusRisk, JFrog Xray, NowSecure, etc.
Design and implement automated security testing guardrails (SAST, SCA, Container scanning, e