At Roche you can show up as yourself, embraced for the unique qualities you bring.

The Position

As an Expert DevSecOps Engineer, acting as a Software Development Security Expert, you will sit at the intersection of software and security engineering. You are accountable for designing robust software development security frameworks, handling ambiguous security and compliance requirements, managing complex stakeholder landscapes, and mentoring junior engineers. You will also collaborate with the area architect in defining the long-term architecture for software engineering security solutions.

Engineering

Excellence &

Experience (E3) enables engineers to explore, plan, design, code, build, test, and deploy software packages in a reliable, secure, automated, and consistent manner across our different business areas. This includes providing facilitated access to automated, composable infrastructure consumable through Infrastructure as Code (IaC) and APIs, both on-premises and in the public cloud. Within E3, you will join the Embedded Security & Testing Team, which champions the integration of testing and security concepts throughout the software development lifecycle. Specifically, the Code Quality, Security, and Testing Engineering team combines best practices and modern solutions to ensure that all code generated is secure and of the highest quality.

Scope: Provides expert-level leadership and strategic guidance in DevSecOps area, including Threat Modelling, Code Quality, SAST, Secret Scanning, Software Composition Analysis, IaC Scanning, License Compliance, Dependency Management, Container Image Scanning, API Security and Container Runtime Scanner. Participate in the definition of Software Security best practices, ensuring consistency, traceability,



and alignment with enterprise standards Leads DevSecOps efforts on strategic activities and provides guidance to less experienced members. Leads the analysis of complex and strategic business problems, defining the problem space and driving comprehensive root cause analysis that may span organizational boundaries Works on unusually complex problems, provides highly innovative solutions, and applies expert-level analytical and logical reasoning to proactively identify strategic opportunities and risks.

Evaluates strategic solution alternatives through rigorous risk assessment and value analysis, ensuring key initiatives align with overall organizational objectives, and recommends optimal technology solutions to drive business transformation. Is accountable for deliverables on significant projects, ensuring alignment with strategic objectives, defining strategic solution scope, and managing complexity Mentors colleagues, helps others develop expertise and skills, and provides guidance to other Experts Actively contributes to organizational development, including showing leadership in Communities of Practice (CoPs). Understands and balances strict security compliances without slowing down developers.

Required Technical Experience: Education: Bachelor’s or Master’s degree in Computer Science, Software Engineering,



or a related technical field (or equivalent practical experience). SonarQube, GHAS, Sysdig, Snyk, IriusRisk, JFrog Xray, NowSecure, etc. Design and implement automated security testing guardrails (SAST, SCA, Container scanning, etc.) directly into DevOps workflows to enable frictionless, secure software delivery.

Experienced in self-service DevOps platforms to automate security via templates for product team Solid understanding of supply chain security to secure software packages, libraries, container images, etc. via security tools, processes and automations. Advanced logical reasoning skills to identify hidden software defects, quality risks, and architectural gaps. Proven ability to manage business analysis activities on complex projects where requirements are highly fluid or loosely defined.

Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a integral impact.

We believe it’s urgent to deliver medical solutions right now – even as we develop innovations for the future. We commit ourselves to scientific rigor, unassailable ethics, and access to medical innovations for all. We are proud of who we are, what we do, and how we do it.

We are many, working as one across functions, across companies, and across the world.

📌 Expert DevSecOps Engineer (Expert Software Development Security Engineer) (Madrid)
🏢 F. Hoffmann-La Roche
📍 Madrid