Job Summary
Role purpose: Build reusable, versioned Checkmarx One security pipeline templates for GitHub Actions and Azure DevOps YAML, while extending the existing pipeline-observability solution through hands-on C#/.NET, TypeScript and React engineering
Key Responsibilities
-
Create reusable GitHub Actions workflows/composite actions and Azure DevOps YAML templates with parameters, stages, jobs, conditions, permissions, secrets and service connections.
-
Integrate Checkmarx One using supported tooling/APIs; implement Security-approved gates, thresholds, exception handling and clear treatment of scanner failures, timeouts and incomplete results.
-
Publish shared, versioned pipeline components with documented inputs/outputs, compatibility expectations, changelogs, upgrade guidance and onboarding examples.
-
Extend the existing observability solution using C#/.NET backend services, REST API integrations and TypeScript/React operational views.
-
Capture and correlate pipeline, stage, job, repository, commit, branch, scan and gate outcomes; expose failures, durations, trends, stale data and links to source executions.
-
Automate tests for templates, integrations, API contracts and views, including failure/recovery scenarios; provide runbooks, handover and support ownership.
-
Prove the implementation in Frontier AI repositories, incorporate adoption feedback and enable reuse by other squads.
Skill Requirements
-
Proven delivery of reusable, versioned CI/CD templates or workflows consumed across multiple repositories or teams, including compatibility and breaking-change management.
-
Hands-on GitHub Actions: reusable workflows, composite actions, versioned references, inputs/outputs, permissions, secrets and troubleshooting.
-
Hands-on Azure DevOps YAML: shared template repositories, parameters, conditions, stages/jobs, variable groups and service connections.
-
Experience integrating application-security scanning into CI/CD, interpreting findings, implementing gates and diagnosing scanner failures.
-
Strong C#/.NET and React solution engineering across backend services, REST APIs and frontend views; hands-on TypeScript required.
-
Experience with API authentication, pagination, retries, rate limits and asynchronous processing.
-
CI/CD observability experience covering execution status, timings, failure categories, traceability and meaningful operational metrics.
-
Strong security awareness: least privilege, secret management, pull-request trust boundaries, secure logging and software supply-chain risk.
-
Git fluency, pull-request reviews, automated testing, troubleshooting and clear technical documentation.
DESIRABLE
-
Checkmarx One or comparable SAST/SCA tooling.
-
Internal engineering portal or observability-solution extension.
-
PowerShell or Python automation; event-driven integrations, structured logging, metrics and alerting.
-
Experience supporting AI-enabled delivery in a regulated environment.
WORKING MODEL
Hands-on delivery with Frontier AI, the DevOps Guild, Security and observability engineers. Security owns policy and exception approval; delivery squads own application remediation and releases; this role owns the shared template and observability capability
Other Requirements
-
Versioned Checkmarx One templates working across representative GitHub Actions and Azure DevOps pipelines.
-
Consistent security-gate behaviour where failed or incomplete scans cannot be mistaken for clean results.
-
Observable pipeline and scan outcomes with actionable drill-down, complete/fresh telemetry and maintainable support documentation.
-
Reusable capability adopted through shared releases rather than copied implementation.