Senior DevSecOps Engineer

We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health®, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time. Position Summary We are seeking an experienced Sr. DevSecOps Engineer to support a large-scale, GCP-native and Azure-connected enterprise environment. The engineer will perform hands on work setting up CI/CD pipelines, GCP infrastructure provisioning, IAM and SSO management, DevSecOps compliance, observability, data integration, and production operations — collaborating daily with Security, EDP, Network, Data Governance, and application engineering teams across all GCP and Azure projects under the organization. Key Responsibilities GCP Infrastructure & GKE Provisioning

• Provision and manage GCP projects, GKE namespaces and clusters, Cloud SQL, BigQuery, GCS, Cloud Composer, Dataproc, and Secret Manager
• Configure Workload Identity Federation (WIF) and environment-specific resources across Dev, PDEV, QA, and Production
• Validate environment readiness and coordinate PRIME and EDP provisioning requests
• Manage infrastructure as code using Terraform; enforce IaC best practices across all environments IAM, Service Accounts, SSO & Access Management
• Create and manage GCP service accounts, AD groups, WIF bindings, token-creator roles, Secret Manager, Cloud SQL, and BigQuery permissions
• Configure Ping SAML/OIDC integrations including client IDs/secrets, redirect URLs, certificates, and environment-specific SSO settings
• Validate AD-group restrictions and login flows; coordinate access requests with application and SSO teams
• Manage fine-grained IAM permissions aligned with least-privilege and compliance requirements Infrastructure Troubleshooting & Production Readiness
• Resolve issues across VPC Service Controls, Zscaler, VPN, firewall, DNS, signed URLs, Composer, Dataproc, Cloud SQL, Secret Manager, and GKE
• Perform environment health checks, remove deployment blockers, and stabilize applications before go-live
• Provide Tier 2/3 production support including incident triage, root cause analysis (RCA), and post-incident documentation
• Coordinate with multiple teams across Network/VPC and Cloud teams to resolve infrastructure dependencies CI/CD, ArgoCD & Release Enablement
• Build, maintain, and optimize GitHub Actions workflows for application and infrastructure delivery
• Configure ArgoCD, environment variables, and secrets; implement WIF-based deployment patterns
• Promote common artifacts across environments; troubleshoot pipeline and ArgoCD authentication failures
• Coordinate PR approvals and production releases; enforce branching and deployment gate standards
• Support platform/library release management and versioning aligned with Agile delivery cadences Observability, Monitoring & Cost Management
• Develop Grafana and GCP-native dashboards; integrate Prometheus and infrastructure metrics
• Configure monitoring scopes, define logging and alerting standards, and establish SLO requirements
• Investigate missing telemetry and ensure full observability coverage across all environments
• Enable BigQuery billing exports and project-level cost visibility; support cost optimization initiatives Data Integration, Governance & Secure File Transfer
• Support BigQuery datasets, views, policy tags, encryption/decryption, fine-grained access, and data quality validation
• Coordinate EDM ingestion/egress, APIs, SFTP/SFG/WebTransport, historical data loads, and secure GCP-to-vendor transfers
• Coordinate approvals and policy enablement with Data Governance and Privacy teams
• Work with Data pipelines, Kafka/GCS streams, and secure data movement Security Risk & Compliance (SRA/SRO)
• Coordinate SRA/SRO intake and reassessments for all GCP projects
• Collect and organize cloud, IAM, network, encryption, logging, vulnerability, and application-control evidence for Archer submissions
• Address rejected evidence, track approvals, and ensure production-readiness compliance
• Liaise with Security Risk team on project build phase compliance gates Snyk, Wiz & Cloud Vulnerability Remediation
• Review and triage Snyk Open Source, Wiz, GitHub Advanced Security, and cloud-security findings across all GCP and Azure projects
• Identify application and repository owners; drive remediation, rescans, and false-positive reviews
• Collect closure evidence and maintain Snyk project attribution accuracy within the GitHub org
• Enforce secure handling of credentials, PII/PHI, service-account keys, and internal endpoints
• Submit and track DevSecOps Ecosystem requests for vulnerability review and reporting scope corrections Technical Project Status, Risk & Dependency Coordination
• Track Key DevOps milestones for projects e.g. Jira ticket, RAID items, security dependencies, environment readiness, and external blockers
• Provide leadership updates on delivery status, risks, and technical blockers BAU DevOps & Cross-Team Engineering Support
• Provide continuous daily support for GCP deployments, SSO, IAM, networking, Data Portal, application access, and production incidents
• Conduct technical working sessions and onboard developers to platform tooling and processes
• Coordinate across Teams, Security, Network, Data Governance, and application teams to resolve cross-functional dependencies
• Mentor junior engineers and enforce DevOps and security best practices across the team Required Qualifications
• 8+ years of experience in DevOps, platform, or SRE roles in enterprise environments
• 5+ years hands-on experience with GCP (GKE, Cloud Build, Cloud Run, Cloud SQL, BigQuery, GCS, Composer, Dataproc, Secret Manager, IAM, VPC)
• 5+ years designing and managing CI/CD pipelines using GitHub Actions, Jenkins, or GitLab CI
• 3+ years managing infrastructure as code with Terraform across multi-environment GCP deployments
• Hands-on experience with ArgoCD or equivalent GitOps tooling for Kubernetes-based deployments
• Proficiency in Workload Identity Federation (WIF) and GCP service account management
• Experience configuring Ping Identity

Saml/oidc Sso

integrations in enterprise environments

• Hands-on experience with Snyk Open Source and/or Wiz for vulnerability management and remediation
• Experience managing GCP IAM, AD groups, fine-grained BigQuery permissions, and Secret Manager
• Strong proficiency in Python and Bash scripting for automation and infrastructure tooling
• Experience with Kubernetes (GKE), Docker, and container-native deployment patterns
• Proficiency in Prometheus, Grafana, and GCP-native monitoring and logging tools
• Experience with VPC Service Controls, VPN, firewall rules, and DNS in GCP environments
• Familiarity with BigQuery data governance including policy tags, encryption, and fine-grained access controls
• Experience with secure file transfer protocols (SFTP, SFG, WebTransport) and data pipelines
• Experience with ServiceNow RITM/REQ workflows for infrastructure and access request management
• Familiarity with GRC process for evidence collection and submission Preferred Qualifications
• GCP Professional DevOps Engineer or equivalent cloud certification (AWS, Azure)
• Experience operating within large-scale GitHub organizations including repo permissions and Snyk project attribution
• Familiarity with Azure environments in addition to GCP
• Experience in healthcare, insurance, or regulated industry environments (HIPAA, SOX compliance awareness)
• Experience with Agile ceremonies — sprint planning, standups, retrospectives
• Experience with Cloud Composer (Airflow), or Dataproc in production environments
• Strong verbal and written