• Design, build, and maintain CI/CD security controls that scale across repositories and teams (reusable pipeline components, templates, and standards). • Implement Kubernetes security architecture and guardrails (RBAC hardening, workload security baselines, admission policies, network policies, and safe multi-tenant patterns as applicable). • Improve container security end-to-end: base-image strategy, vulnerability scanning, registry controls, image signing, and promotion workflows. • Operationalize vulnerability management with risk-based prioritization, measurable remediation SLAs, and dashboards/metrics (MTTR, exposure trends, top recurring root causes). • Drive developer enablement: clear documentation, lightweight design reviews/threat modeling for high-impact changes, office hours, and high-signal guidance embedded in tooling. • This role builds and runs production security systems. • You'll ship code and infrastructure, not just recommendations • You'll own reliability and outcomes for the controls you build. • You'll respond to incidents and on-call rotation related to platform security controls and pipeline reliability (scope aligned with Platform/SRE).