Senior DevSecOps Engineer – Kubernetes & Software Supply Chain Security

📋 Job Overview

Permanent position at Twoday | Copenhagen. We are looking for an experienced, hands-on DevSecOps Engineer to strengthen security across development pipelines, Kubernetes platforms and production environments for one of our major public-sector clients. This is a role for someone who implements, automates and maintains security controls – not someone who only advises on them.

🏢 About Twoday

Twoday is a leading technology consulting company specializing in applied AI and advanced engineering. With around 2,300 experts in AI, data, digital engineering, and cloud engineering, we cut through complexity, remove uncertainty, and prove the value of technology. Our purpose is to create a better tomorrow through AI and technology. We strengthen private and public organizations across energy and utilities, financial services and insurance, industrials and manufacturing, health and life sciences, and government. However, our greatest strength isn't the technology we work with. It's the people behind it. Every day, they bring together expertise, curiosity, and determination to help our customers solve complex challenges and create lasting value.

🎯 The Role

You will work alongside an experienced operations team, embedding security into development, deployment and daily operations while helping the team adopt secure, sustainable engineering practices.

✅ Key Responsibilities

• Implementing automated security controls across CI/CD pipelines, including SAST, SCA, secret scanning, container scanning and Infrastructure as Code (IaC) scanning.
• Securing the software supply chain through SBOM generation (CycloneDX/SPDX), artefact signing and verification (e.g. Sigstore/cosign), SLSA principles and secure branch, review and release processes.
• Securing CI/CD pipelines and runners using least-privilege principles.
• Implementing Kubernetes security controls, including admission control, policy-as-code, Pod Security Standards, RBAC, network policies and secrets management.
• Hardening Linux and Windows environments and managing vulnerabilities from identification through to remediation.
• Supporting runtime threat detection, security monitoring, incident response and forensic investigations.
• Establishing security frameworks for AI-assisted development and autonomous AI agents, including controlled permissions, review gates, traceability and protection against prompt injection.
• Documenting security controls for compliance and audit purposes, while sharing knowledge and transferring solutions to the internal team.

📌 Required Qualifications

• Practical DevSecOps experience and can demonstrate that you have implemented security controls in real development and production environments.
• Experience with software supply chain security: SAST, SCA, secret scanning, SBOM, artefact signing and verification, container and IaC scanning.
• Experience with CI/CD and automation: GitLab CI, GitHub Actions or similar, secure pipelines and runners, Terraform, Ansible and scripting with Python, Bash or PowerShell.
• Experience with Kubernetes security: Kyverno, OPA Gatekeeper or similar, admission control, Pod Security Standards, RBAC, network policies and secrets management using Vault, External Secrets or equivalent.
• Experience with platform security: CIS-based Linux hardening, Windows Server hardening and runtime detection tools such as Falco.
• Experience with vulnerability management and incident response: Risk-based remediation, logging, SIEM solutions such as ELK or Wazuh, incident handling and forensics.
• Experience with AI security: Security controls for AI-assisted and agentic workflows, including autonomy boundaries, human review, prompt injection protection and secure credential handling.
• Experience with compliance: NIS2, ISO 27001/27002 and GDPR.

⭐ Desirable Experience

• Experience with virtualisation platforms such as Proxmox.
• Experience from the public sector or organisations subject to NIS2.

🎁 Benefits

The environment follows an open-source-first approach with EU-based infrastructure. Experience with US hyperscalers is not relevant to this assignment. You must be fluent in Danish and English, both written and spoken, and able to work onsite full time in Copenhagen.

🛂 Visa & Eligibility

You must be able to work onsite full time in Copenhagen.