Lead DevSecOps Engineer

About McKesson

McKesson is a Fortune 10 company deeply committed to enhancing healthcare by delivering insightful products and services that make quality care both affordable and accessible. Our organization prioritizes the health, well-being, and happiness of the people we serve and our employees, fostering an environment where growth and innovation thrive. Join us to help shape the future of health for patients, communities, and employees alike.

Key Responsibilities

• Lead enterprise-wide security and DevSecOps initiatives spanning cloud, on-premises, and hybrid setups.
• Architect and deploy scalable security controls fully embedded within CI/CD pipelines and developer platforms.
• Promote the adoption and operational use of security tools such as GitHub Advanced Security, OWASP ZAP, Veracode, and SonarQube.
• Manage software supply chain security efforts utilizing JFrog Xray/Curation, Black Duck, Sonatype, and FOSSA tools.
• Automate and integrate security processes using scripting languages including Python, Bash, and JavaScript.
• Collaborate with engineering and platform teams to embed secure-by-design principles into applications, APIs, containers, and cloud workloads.
• Offer leadership during security incidents, oversee vulnerability management, and support remediation activities.
• Mentor engineering staff while guiding enterprise security architecture, standards, and future roadmaps.
• Develop and uphold security standards for Kubernetes, containers, Infrastructure as Code (Terraform), and cloud-native platforms.
• Create and maintain security automation, policy-as-code, and self-service tools that enhance developer experience and reduce organizational risks.

Required Qualifications

• Over 10 years of advancing experience in cybersecurity engineering, application security, cloud security, or related fields.
• Bachelor's degree or equivalent experience in Computer Science, Cybersecurity, Information Technology, or Engineering.
• Proven expertise implementing and managing enterprise security tools like GitHub Advanced Security, SonarQube, and OWASP ZAP.
• Experience with software supply chain and open-source risk management technologies such as JFrog Xray/Curation, Black Duck, Sonatype, and FOSSA.
• Proficiency in Python, Bash, JavaScript, or related scripting languages for automation purposes.
• Hands-on experience securing CI/CD pipelines with platforms such as GitHub Actions, Jenkins, GitLab CI, or Azure DevOps.
• Demonstrated ability securing cloud environments on AWS, Azure, and/or Google Cloud Platform.
• Solid knowledge of containerization and orchestration technologies like Docker and Kubernetes.
• Experience in managing enterprise source code management platforms, developer ecosystems, and software delivery infrastructure.

Preferred Experience and Skills

• Master’s degree in Cybersecurity, Computer Science, or a closely related discipline.
• Experience with policy-as-code, infrastructure-as-code security, and automated security governance.
• Skilled in threat modeling, secure code reviews, and application security testing methodologies.
• A strong understanding of zero-trust architectures, identity security, cryptography, and cloud-native security controls.
• Proven capability in producing security metrics, dashboards, and executive-level security reporting.
• Relevant professional certifications such as CISSP, CCSP, CSSLP, AWS Security Specialty, Azure Security Engineer, or GIAC.
• Experience driving large-scale security transformations in highly regulated sectors.
• Leadership experience mentoring engineers and guiding multiple teams.
• Expertise in securing Kubernetes platforms, container registries, and cloud-native environments.
• Implementing advanced software supply chain security controls, including artifact signing, SBOM management, provenance, dependency governance, and secure build processes.

Additional Information

McKesson emphasizes the well-being of its employees and patients by offering a comprehensive Total Rewards package that supports physical, mental, and financial health. Compensation is competitive and reflective of experience, performance, skills, equity considerations, and geographic market factors. The salary range provided for this role is €82,500 to €137,500 annually, potentially including bonuses and long-term incentives.

Note: Candidates should beware of recruiting scams using McKesson's name; McKesson recruiters will never request money or credit card details, and communications are not done through unofficial email accounts or chatrooms.