SO, WHAT’S THE STORY?
The DTC team consists of agile squads delivering Dr. Martens’ global digital commerce experience. We have adopted a customer\-centric strategy and use modern engineering practices to serve our customers in a manner that is authentic with the brand values.
The DevSecOps Engineer will be a core member of the Brand Experience team, enabling reliable, secure and compliant delivery of our Next.js (React) storefront with a Backend\-for\-Frontend (BFF) pattern hosted on AWS. The team operates a “You Build It, You Run It” model where security is engineered in — not bolted on.
This role focuses on embedding security across the entire software delivery lifecycle: secure cloud foundations, hardened pipelines, automated threat and vulnerability management, identity and secrets governance, runtime protection, and audit\-ready compliance — so product teams ship faster, with confidence, while meeting global performance, privacy and regulatory expectations in a digital commerce environment.
THE GIG
As the DevSecOps Engineer, you will
1\. **1\) AWS Cloud \& Platform Security**
- Design and operate secure\-by\-default AWS foundations for Next.js and BFF workloads, including VPC design, segmentation, edge/CDN protections, and resource\-level controls aligned to least privilege.
- Own Infrastructure as Code (IaC) security standards using Terraform and/or CloudFormation, embedding policy\-as\-code (e.g., Checkov, tfsec, OPA/Conftest) and reusable hardened modules.
- Define and enforce baselines for IAM, KMS, networking, logging, and account/landing\-zone guardrails (e.g., AWS Config, Security Hub, GuardDuty, SCPs).
2\. **2\) Secure CI/CD \& Software Supply Chain**
- Build and harden CI/CD pipelines (e.g., GitHub Actions, GitLab CI, Jenkins, AWS\-native tooling) with integrated SAST, DAST, SCA, IaC scanning, container image scanning, and secrets detection.
- Implement software supply chain controls: signed commits, artifact signing, SBOM generation, dependency provenance, and protected release paths.
- Enable progressive delivery, zero/low\-downtime deployments, and safe rollback patterns without compromising security gates.
3\. **3\) Threat \& Vulnerability Management**
- Operate continuous vulnerability discovery across cloud, container, application and dependency layers; drive risk\-based prioritisation and remediation SLAs.
- Lead threat modelling and secure design reviews for new features, partnering with engineering and architecture to identify and mitigate risks early.
- Define and operate web application protections (WAF, bot mitigation, rate limiting) for storefront and BFF endpoints.
4\. **4\) Identity, Secrets \& Data Protection**
- Own secrets management and rotation (e.g., AWS Secrets Manager, Parameter Store, HashiCorp Vault), eliminating hard\-coded credentials across services and pipelines.
- Implement encryption in transit and at rest, certificate lifecycle management, and key governance using KMS.
- Govern human and workload identity: federation, OIDC for pipelines, role\-assumption patterns, and just\-in\-time access.
5\. **5\) Compliance, Risk \& Governance**
- Operationalise compliance for digital commerce: GDPR\-aligned data handling, PCI\-DSS scope reduction, and customer data protection through automation and guardrails.
- Automate evidence capture, control validation, and audit\-ready reporting; partner with InfoSec, Legal and Privacy stakeholders.
- Maintain security policies, exception management, and risk registers relevant to the DTC platform.
6\. **6\) Observability, Detection \& Incident Response**
- Build security observability: centralised logging, security telemetry, anomaly detection, and alerting using CloudWatch/Datadog/SIEM (or equivalent).
- Participate in on\-call rotation; lead security incident triage, coordinate response, and deliver high\-quality RCAs with prevention actions.
- Define SLIs/SLOs for security\-relevant signals (e.g., mean time to detect/respond, patch latency, control coverage).
7\. **7\) Developer Enablement \& Security Culture**
- Provide self\-service security tooling, golden paths, and pre\-approved patterns so engineers can move fast safely.
- Produce clear runbooks, playbooks, secure coding guidance and threat\-modelling templates to reduce operational and cognitive load on engineers.
- Champion a security\-first culture through coaching, lightweight reviews, and visible metrics.
THE STUFF THAT SETS YOU APART
- *Must\-have Experience \& Skills**
- Strong hands\-on experience securing and operating production workloads on AWS.
- Proven experience embedding security into IaC (Terraform and/or CloudFormation), including policy\-as\-code and modular hardened patterns.
- Solid background designing and maintaining secure CI/CD pipelines with integrated SAST, DAST, SCA, IaC and container scanning.
- Experience with vulnerability management, threat modelling, and risk\-based remediation across cloud, application and dependency layers.
- Working knowledge of web application security (OWASP Top 10, API security, WAF, bot/rate\-limit controls).
- Strong operational discipline: incident response, RCA, change management, and runbook\-driven operations.
- Ability to collaborate effectively with cross\-functional product teams and communicate security risk in clear, actionable terms.
- *Technical Skills (Expected)**
- AWS security fundamentals: IAM, KMS, VPC, Security Hub, GuardDuty, Config, CloudTrail, WAF/Shield.
- Containers and/or serverless security (ECS/EKS/Lambda), image hardening, and runtime protection concepts.
- Secrets management (AWS Secrets Manager, Parameter Store, Vault) and certificate lifecycle management.
- Security tooling across the SDLC: SAST/DAST/SCA, IaC scanners (Checkov/tfsec), container scanners (Trivy/Grype), secrets scanners.
- Observability and SIEM concepts (CloudWatch, Datadog, OpenTelemetry, structured logging, log/event correlation).
- Scripting and automation skills (e.g., Bash, Python, or Node.js).
- Familiarity with modern web delivery (Next.js build/deploy patterns, CDN/edge, API gateway/BFF considerations) and their security implications.
- *Soft Skills (What sets you apart)**
- **Ownership:** You take accountability for security, reliability, delivery outcomes and continuous improvement.
- **Pragmatism:** You balance risk and velocity, choosing controls that protect the business without slowing teams down.
- **Problem solving:** You approach incidents and security issues with structured thinking and data.
- **Communication:** You explain complex security risks in clear, actionable terms to engineers, leadership and non\-technical stakeholders.
- **Continuous learning:** You stay current with cloud security practices, tooling, attacker techniques and regulatory standards.
- Bachelor’s degree in Computer Science, Information Systems, Cyber Security or a related field (or equivalent practical experience).
- Relevant certifications (e.g., AWS Security Specialty, CISSP, CCSP, CKS, OSCP, ISO 27001 Lead Implementer/Auditor) are a plus.
- Experience supporting global retail/e\-commerce platforms with high availability, performance and regulatory requirements.
- Experience with PCI\-DSS scoping, GDPR\-aligned data protection, and audit\-ready operational processes.
- Experience implementing distributed tracing, SLO\-based operational models and security telemetry pipelines.
- Experience enabling self\-service developer platforms (templates, golden paths, paved roads for security).
- Familiarity with Zero Trust architectures, service mesh security, and API gateway protection patterns.
We live and breathe Rebellious Self Expression at Dr. Martens, and there are 3 core values at the heart of it. They never stand alone, but work together as a balancing act of rights and responsibilities to support how we work together at DMs. **BE YOURSELF**. **ACT COURAGEOUSLY**. **SHOW YOU CARE**.
At DM your technical capability will go hand in hand with the below
- Great relationship management that delivers results through effective teamwork.
- You’ll be a proud custodian to our DM’s culture, embodying what we stand for and encouraging others to do the same.
- You’ll help build a highly engaged team – ensuring a collaborative culture and providing guidance and support to other team members.
- You will take ownership for your own development, proactively seeking out feedback to build self\-awareness.
- You will bring the outside\-in; you’ll share best practice across the team/business and encourage idea sharing as well as collaborative problem solving.
- You’ll lead the way and role model on all things DE\&I and wellbeing.