••••••• enables the people behind the world’s most important structures to do their best work. We connect architects, engineers, contractors, and owners in one shared 2D/3D environment to help deliver complex projects on time and on budget. From airports and hospitals to data centers and large-scale infrastructure, ••••••• supports industry leaders in reducing risk, improving collaboration, and delivering better project outcomes.

Built on a gaming engine, ••••••• is designed to handle the scale and complexity of modern construction projects while remaining fast, reliable, and accessible across devices and environments — whether teams are in the office or on site.

Key Responsibilities & Requirements

Infrastructure Security & Compliance
As a cornerstone of this role, you will ensure our cloud foundations are resilient and compliant
by design.

  • Design and implement secure cloud infrastructure using Terraform/Terragrunt, following
  • security best practices and CIS benchmark compliance
  • Build vulnerability management workflows: scanning, triage, and remediation across
  • cloud and endpoint estate
  • Deploy and tune log-aggregation/detection infrastructure for automated incident
  • response
  • Design network segmentation for containerized and cloud-native environments.
  • Expert-level experience with Terraform/Terragrunt across multi-account, multi-region
  • environments (5+ years preferred)Kubernetes & Container Security
  • You will lead the hardening of our servers, containerized environments and orchestrate secure
  • runtime policies.
  • Design secure Kubernetes cluster bootstrapping, node hardening, and control-plane configuration
  • Implement Pod Security Standards, network policies, and RBAC via IaC
  • Establish golden-image programs and container vulnerability scanning/policy enforcement for image registries
  • Maintain hands-on experience with container runtime security and registry-integrated scanning
CI/CD & Source Code Security
  • In this capacity, you will integrate security directly into the developer experience and supply chain.
  • Design secure CI/CD pipeline infrastructure with SAST/DAST integration and security gates
  • Implement organization-wide GitHub security policies: branch protection, secret scanning, and dependency management
  • Apply knowledge of supply-chain security controls and automated security testing frameworks

Secrets, Identity & Endpoint Hardening
  • Manage critical identity infrastructure and enforce rigorous hardening standards across all endpoints
  • Implement secrets management infrastructure (e.g., HashiCorp Vault) for application and infrastructure credentials
  • Design IAM across cloud environments and support Zero Trust initiatives
  • Harden databases (MySQL, PostgreSQL, Redis) against encryption and access-control best practices
  • Build backup/DR infrastructure with robust encryption and security controls

Core Skills
  • Technical mastery and a proactive troubleshooting mindset are essential for success in this role.
  • Proficiency in security automation scripting (Python, Go, or Bash)
  • Experience in threat modeling and security architecture review
  • Comfortable owning infrastructure troubleshooting through to incident response

Preferred Qualifications
  • The ideal candidate brings advanced certifications and experience with specialized security tooling.
  • Security certifications such as AWS Security Specialty, CISSP, CCSP, or Azure Security Engineer
  • Experience with container security platforms (e.g., Falco, OPA Gatekeeper, Prisma Cloud) and service mesh security (Istio/Linkerd)
  • Familiarity with SOAR/security automation platforms and infrastructure penetration testing
  • Familiarity with GitOps and secure software supply-chain methodologies

Position Overview

DevSecOps Engineer responsible for security-first infrastructure architecture, threat detection, and compliance across our multi-cloud environment, with primary emphasis on AWS. Alibaba Cloud and GCP are expansion targets — current Terraform/Terragrunt modules and CIS benchmark tooling are AWS-only; this role will help build out equivalent coverage for the other platforms. Owns secure IaC delivery, Kubernetes/container security, and CI/CD supply-chain security.

Why Join Us

  • Recognised as one of Switzerland’s Best Managed Companies by Deloitte for three consecutive years from 2024 through
  • Company-wide trips, including Armenia in 2023 and Switzerland in 2025, with more to come
  • A flexible, employee-focused culture
  • An innovative and collaborative team environment
  • Great working conditions designed to support your best work

We can only accept applications from candidates based in Germany, France or the UK.