Work Schedule
First Shift (Days)
Environmental Conditions
Office
Job Description
Thermo Fisher Scientific Inc. (NYSE: TMO) is the world leader in serving science, with revenues of more than $20 billion and approximately 65,000 employees globally. Our mission is to enable our customers to make the world healthier, cleaner and safer. We help our customers accelerate life sciences research, solve complex analytical challenges, improve patient diagnostics, deliver medicines to market and increase laboratory productivity. Through our premier brands – Thermo Scientific, Applied Biosystems, Invitrogen, Fisher Scientific and Unity Lab Services – we offer an unmatched combination of innovative technologies, purchasing convenience and comprehensive services
We are seeking a DevSecOps Engineer to integrate security practices into our DevOps processes, ensuring that applications and infrastructure are secure by design. This role focuses on embedding security controls across the CI/CD pipeline, enabling secure software delivery while maintaining development velocity.
You will work closely with development, QA, DevOps, and security teams to identify risks, implement automated security checks, and enforce best practices across the software development lifecycle. The role requires a proactive mindset to continuously improve security posture in complex, distributed environments
Key responsibilities include, but are not exclusively:
Design, implement, and maintain secure CI/CD pipelines using Jenkins and GitLab, ensuring integration of security controls throughout the software delivery lifecycle
Manage and maintain artifact repositories, ensuring proper classification of internal vs. external packages and secure usage of package sources (NuGet, Conan, Sky)
Secure containerized environments (Docker, Kubernetes), including image hardening, access control (RBAC), and vulnerability scanning
Define, implement, and enforce security policies, standards, and compliance controls across development and DevOps workflows
Participate in Agile processes using Jira, contributing to sprint planning, backlog refinement, and continuous improvement initiatives
Work within Scrum, Kanban, and scaled Agile (ART) environments, collaborating with cross-ART teams to align on shared security practices
The ideal candidate combines strong DevOps expertise with deep knowledge of application security,
software supply chain security, and regulatory compliance, and thrives in complex, highly regulated environments.
University degree in Computer Science, Cybersecurity, Software Engineering, or a related technical discipline
Experience managing artifact repositories and package ecosystems, including NuGet, Conan, and internal repositories (e.g., Sky), with clear understanding of internal vs. external package classification
Experience integrating static code analysis and security scanning tools (e.g., SonarQube, TICS, CodeQL) into CI/CD pipelines
Experience securing containerized environments using Docker and Kubernetes, including image hardening, RBAC, and vulnerability scanning
Experience defining, implementing, and enforcing security policies, standards, and compliance controls across development and DevOps processes
Experience working in audit-driven and regulated environments, with ability to produce documentation, traceability, and compliance evidence (e.g., via Confluence)
Experience working in Agile environments using Jira, including Scrum, Kanban, and scaled Agile frameworks (ART)
Strong analytical, risk assessment, and problem-solving skills, with the ability to identify vulnerabilities and propose effective mitigation strategies
Proven ability to collaborate effectively with development, QA, DevOps, and infrastructure teams to drive secure development practices
