DevSecOps Engineer

We're a leading e-commerce print company operating two distinct online brands, Route 1 Print and Instantprint. Our core mission is simple: to make print buying as easy as possible for small businesses.

An opportunity has arisen for a DevSecOps Engineer to join our technology team. You'll be responsible for the security of the cloud infrastructure and development pipelines behind both brands — and for fixing the issues you find.

More of our code is now written with AI. That speeds up delivery, but every change still has to be secure — and the volume of change moving through our pipelines makes that impossible to guarantee by hand. This role exists to build security into how we ship, and to keep our cloud infrastructure in good shape.

This is a hands-on engineering role, not an advisory one. You will be responsible for actioning and fixing security findings, not just reporting them. When a scan flags a vulnerable dependency, a misconfigured bucket, or an over-permissive role, you'll take technical ownership of the remediation, delivering fixes directly wherever possible and coordinating with other teams when needed.

You'll work closely with our website, internal systems, and IT teams, agreeing priorities with them and making the changes yourself wherever you can.

• Take technical ownership of security findings across our cloud, application, and internal environments: triaging and prioritising them by real risk, delivering fixes directly wherever possible, and coordinating remediation with other teams when needed.
• Fix issues within agreed timescales by severity, and report open findings and how long they've been open to the leadership team each month.
• Where practical, introduce automated controls, tests, or monitoring to prevent resolved security issues from recurring.
• Implement and maintain automated security scanning across our CI/CD pipelines, covering application code, dependencies, containers, and Infrastructure as Code (IaC). Configure and tune the tooling to identify genuine risks without unnecessarily slowing development.
• Set guardrails for AI-written code, including checks on new dependencies and clear limits on what AI coding tools and agents can access.
• Harden the pipelines themselves: branch protection, least-privilege permissions, and short-lived deployment credentials.
• Own the security of our AWS environment — least-privilege IAM, S3 access, logging, and threat detection.
• Review our existing infrastructure on an ongoing basis against recognised benchmarks such as CIS, making the updates and configuration changes required.
• Use automation and Infrastructure as Code wherever practical to implement consistent, repeatable security improvements rather than relying on manual configuration changes.
• Assess and improve the security of application APIs and third-party integrations, addressing authentication, authorisation, and configuration weaknesses.
• Own the output of our vulnerability scanning, working with our IT team to get internal systems patched and configured correctly.

• A background in DevOps, platform, or cloud engineering, now specialising in security. This role needs someone who builds and fixes, not someone who only audits.
• Strong experience (typically 4+ years) across DevOps or cloud engineering, with a significant focus on security.
• Hands-on AWS security experience, including IAM, S3, CloudTrail, GuardDuty, Security Hub, and AWS Config.
• Hands-on ownership of CI/CD pipelines (e.g., GitHub Actions, Jenkins, TeamCity, Azure DevOps), including adding security gates to them.
• Practical experience implementing and managing application security tooling, including static analysis (SAST), software composition analysis (SCA), secrets scanning, and Infrastructure as Code security scanning.
• Comfortable reading and fixing application code in at least one modern language (e.g., C#, Java, Go, or similar).
• Experience with Infrastructure as Code (e.g., Terraform, CloudFormation, Pulumi), and a sharp eye for insecure configurations within it.
• Knowledge of containerisation (e.g., Docker) and how to secure images and container workloads.
• An understanding of the security risks AI-assisted development introduces, and how to manage them without slowing down delivery.
• The judgement to prioritise by real risk, alongside the confidence to take ownership, challenge existing thinking, and see fixes through.
• Security certifications (e.g., AWS Certified Security – Specialty) or experience with Cyber Essentials Plus, ISO 27001, or PCI DSS are beneficial, but not essential.

• Real ownership: Security across our cloud and delivery pipelines — you set the standards and make the fixes.
• Preventive, engineering-led focus: 24/7 threat monitoring is handled by our managed detection partner, so your time goes into making things more secure.
• Modern tooling: Investment in modern security tooling, with the freedom to shape how security is integrated into our development processes.
• High impact: High-traffic, commercially critical platforms where your work protects the business and our customers.
• Great culture: A culture that values curiosity, experimentation, and continuous learning.
• Work-life balance: Flexible, hybrid working and a small, capable team.

At Bluetree Group, we don’t just print; we innovate. We believe in investing in the people who make our success possible. Here’s how we look after you:

• Health First: Access to a market-leading Health Cash Plan and comprehensive wellbeing support, including onsite training and free external support.
• Family Support: Enhanced maternity, paternity, and adoption packages to support your life outside of work.
• Rest & Recharge: 22 days annual leave (plus Bank Holidays), with a "Length of Service" programme that earns you more days the longer you stay.
• Social: From regular team socials to our legendary annual Summer and Christmas Parties, plus biennial Long Service celebrations — we know how to celebrate success.
• Financial Wellness: Enrolment in our company pension scheme.
• Rewards: Access to various discounts via Bluetree Rewards, weekend break giveaways, and long-service gifts to mark your milestones starting from year 1!
• Career Development: We champion personal development with a wide range of internal and external training opportunities available.
• Fitness: Save on a new bike with our Cycle to Work scheme, or join our weekly football team to burn off some steam!
• Daily Comforts: Fuel your day with free fruit, snacks, and beverages in our modern canteen.
• Easy Commute: Free onsite parking at our state-of-the-art facility. We are also ideally located for public transport, just minutes from Mexborough, Swinton, and Wombwell train stations.

Ready to grow with us?

For Privacy information, please follow this link to our privacy notice on our website homepage:https://www.bluetreegroup.co.uk

#LI-Onsite