DevSecOps Engineer - Kubernetes, IaC & Pipeline Security ?

At Shakers we are working with an AI-native tech lab launching in Barcelona to bring in its first DevSecOps Engineer. Freelance project, 5 months of initial duration, hybrid model in Barcelona. Greenfield platform, zero legacy.

The challenge

There is no delivery platform yet: machines, network, ingress, access, environments, pipelines and observability are all still to be built. You come in as the first DevSecOps profile and own that foundation end to end, deciding what gets automated, what gets hardened and where Kubernetes genuinely pays off. A large part of the work is designing a golden path that the rest of the engineering team actually uses day to day, and securing an environment where AI agents operate without ever touching real credentials.

Autonomy and technical judgement weigh more here than following an existing playbook.

Responsibilities

- Build reproducible infrastructure as code covering machines, networking, ingress, access and environments
- Design a golden path that ships an application with a single command, with repository, CI/CD and monitoring scaffolded automatically
- Set up secrets management so that AI agents never hold real keys
- Embed security controls into the delivery pipeline: static analysis, dependency and image scanning, secret detection,



IaC checks and dynamic testing
- Put observability in place across the platform
- Own backup and restore procedures, including tested recovery drills
- Build the road to production: test gates, per-branch preview URLs and rehearsed rollbacks

Requirements

- Track record building infrastructure from zero that other engineers actively use
- Solid Infrastructure as Code: Terraform, Ansible, Helm, Argo CD
- Kubernetes in production (HA clusters, day-2 operations) plus the judgement to say when Kubernetes is not the answer
- Comfort operating self-hosted and bare-metal servers, not only managed cloud
- CI/CD on GitLab CI or Jenkins with security integrated into the pipeline (Trivy, Semgrep, SonarQube, ZAP, DefectDojo, Vault or Infisical)
- First-hand ownership of backup processes, including real data restorations
- Fluent English, the working language of the project
- Availability for a hybrid model in Barcelona (2 days per week on-site)

Nice to have

- CKA certification
- Experience hardening environments where AI agents run (credentials, cost control, production gates)
- Spanish

If this fits you, or someone in your network, apply or share it. We get back fast ?

#DevSecOps #Kubernetes #Terraform #CICD #CloudSecurity #Freelance #Shakers

📌 DevSecOps Engineer (Barcelona)
🏢 Shakers
📍 Barcelona