We're looking for a DevSecOps engineer to build and own the pipelines that take Keyek code from a pull request to production. You'll build our CI/CD in GitHub Actions, put security testing into every stage, and make the safe path the easy one for our engineers. Our customers trust us with their identity, and many of them will ask how our software is built. You'll help us answer that with evidence: scanned code, known dependencies, signed builds and controlled releases.
Key responsibilities
Design, build and maintain CI/CD pipelines in GitHub Actions across our products
Build reusable workflows and composite actions so teams get a consistent pipeline without copying YAML
Deploy to AWS from pipelines using OIDC federation rather than long-lived keys
Run self-hosted runners where we need them, and keep them patched and isolated
Make builds faster and more reliable, and track the metrics that show it
Integrate and tune static analysis (SAST), such as CodeQL or Synk, so findings are real and actionable
Run software composition analysis (SCA) and dependency management, using tools such as Dependabot, Snyk or similar
Add secret scanning, container and image scanning, and infrastructure-as-code scanning for our Terraform
Produce SBOMs and sign build artifacts, working towards SLSA-style build provenanceSet up branch protection,



required reviews and workplace approvals so changes to production are controlled and traceable
About you
At least 4 years in DevOps, platform or build engineering, with at least 2 years focused on security in the delivery pipeline
Deep hands-on experience with GitHub Actions, including reusable workflows, environments, secrets and OIDC
Experience rolling out SAST, SCA and secret scanning tools, and tuning them to cut noise
Solid experience with AWS and infrastructure as code, ideally Terraform
Experience with containers (Docker) and container registries
Scripting in Bash and at least one of Python or Go
A good grasp of supply chain security: SBOMs, artifact signing and dependency risk
Clear writing. Your pipeline docs and findings should make sense without a follow-up call
The ability to work with engineers rather than against them, and to explain why a control matters
Rights to work in Australia
About us
Keyek builds hardware-enforced identity for enterprise. Keyek Card gives people a phishing-resistant sign-in with one PIN and no passwords. Keyek Mod proves a machine's identity in hardware before it connects. The Keyek Platform ties them together, and every interaction is verified HSM to HSM. Our product engineering team is based in Australia, and we manufacture in Hindmarsh, South Australia.
#J-*****-Ljbffr

📌 Senior Devsecops Engineer (Melbourne)
🏢 KEYEK
📍 Melbourne