Senior DevSecOps Engineer

About the role

We're looking for a DevSecOps engineer to build and own the pipelines that take Keyek code from a pull request to production. You'll build our CI/CD in GitHub Actions, put security testing into every stage, and make the safe path the easy one for our engineers. Our customers trust us with their identity, and many of them will ask how our software is built. You'll help us answer that with evidence: scanned code, known dependencies, signed builds and controlled releases.

Key responsibilities

• Design, build and maintain CI/CD pipelines in GitHub Actions across our products
• Build reusable workflows and composite actions so teams get a consistent pipeline without copying YAML
• Deploy to AWS from pipelines using OIDC federation rather than long-lived keys
• Run self-hosted runners where we need them, and keep them patched and isolated
• Make builds faster and more reliable, and track the metrics that show it
• Integrate and tune static analysis (SAST), such as CodeQL or Synk, so findings are real and actionable
• Run software composition analysis (SCA) and dependency management, using tools such as Dependabot, Snyk or similar
• Add secret scanning, container and image scanning, and infrastructure-as-code scanning for our Terraform
• Produce SBOMs and sign build artifacts, working towards SLSA-style build provenance
• Set up branch protection, required reviews and environment approvals so changes to production are controlled and traceable

About you

• At least 4 years in DevOps, platform or build engineering, with at least 2 years focused on security in the delivery pipeline
• Deep hands-on experience with GitHub Actions, including reusable workflows, environments, secrets and OIDC
• Experience rolling out SAST, SCA and secret scanning tools, and tuning them to cut noise
• Solid experience with AWS and infrastructure as code, ideally Terraform
• Experience with containers (Docker) and container registries
• Scripting in Bash and at least one of Python or Go
• A good grasp of supply chain security: SBOMs, artifact signing and dependency risk
• Clear writing. Your pipeline docs and findings should make sense without a follow-up call
• The ability to work with engineers rather than against them, and to explain why a control matters
• Rights to work in Australia

About us

Keyek builds hardware-enforced identity for enterprise. Keyek Card gives people a phishing-resistant sign-in with one PIN and no passwords. Keyek Mod proves a machine's identity in hardware before it connects. The Keyek Platform ties them together, and every interaction is verified HSM to HSM. Our product engineering team is based in Australia, and we manufacture in Hindmarsh, South Australia.