Senior DevSecOps Engineer – GCP

About the role

We are looking for a Senior DevSecOps Engineer with deep expertise in Google Cloud Platform (GCP) to lead the security hardening of our cloud environment. You will work closely with engineering, data, DevOps, product and management teams to embed security controls while keeping services running smoothly.

Key responsibilities

• Review, audit and strengthen security across all GCP projects, folders, billing accounts, service accounts, IAM roles, APIs, workloads and third‑party integrations.
• Maintain a centralized inventory of enabled services such as Cloud Run, Cloud Functions, BigQuery, Cloud Storage, Pub/Sub, Firebase and related resources.
• Implement and manage GCP Organization Policies to prevent risky configurations, public access and insecure deployments.
• Audit IAM access at project and organization level, removing unauthorized or excessive permissions and applying least‑privilege principles.
• Secure API keys, OAuth clients, service accounts, Firebase projects, Cloud Run services, BigQuery datasets, Cloud Storage buckets and Pub/Sub topics.
• Replace long‑lived service‑account keys with Secret Manager, Workload Identity Federation, short‑lived credentials or controlled impersonation.
• Configure budget kill‑switches, monitoring, alerting and incident detection using Cloud Billing, Pub/Sub, Cloud Logging, Cloud Monitoring, Security Command Center and IAM Recommender.
• Identify and remediate unused, risky or publicly exposed services, coordinating with relevant teams for mitigation or decommission.
• Document security policies, access‑review processes, incident‑response workflows and onboarding standards.

Required profile

• Proven experience reviewing, auditing and strengthening security across GCP environments.
• Hands‑on experience implementing GCP Organization Policies and IAM least‑privilege controls.
• Ability to assess security impact on production systems and design secure workarounds.

Required skills

• Google Cloud Platform (GCP)
• IAM, Service Accounts, Organization Policies
• Cloud Run, Cloud Functions, BigQuery, Cloud Storage, Pub/Sub, Firebase
• Secret Manager, Workload Identity Federation
• Cloud Logging, Cloud Monitoring, Security Command Center
• IAM Recommender, audit logs, billing alerts