DevSecOps Engineer

At Motorola Solutions, we believe that everything starts with our people. We're a global close-knit community, united by the relentless pursuit to help keep people safer everywhere. We build and connect technologies to help protect people, property and places. Our solutions foster the collaboration that's critical for safer communities, safer schools, safer hospitals, safer businesses, and ultimately, safer nations. Connect with a career that matters, and help us build a safer future.

CRFS is seeking a Dev Sec Ops  Engineer to join our Dev Ops team and help build security into the way we develop, build and release our products. As we provide the gold standard in spectrum intelligence to defense agencies, spectrum regulators, and systems integrators, our software must satisfy demanding customer and regulatory security requirements. You will help ensure that our embedded, desktop and web software is secure, resilient, and delivered through robust automated pipelines.

This is a hands-on, mid-level role. It will suit an engineer with a few years' experience of CI/CD and Linux, a genuine interest in security, and the ability to take ownership of well-defined areas of work with support from senior colleagues.

• CI/CD Pipelines:
  Build, maintain and improve the automated pipelines (Git Lab CI and Team City) that build, test, scan, package and release CRFS software across our embedded Linux, Windows desktop, web and firmware products.
• Security Scanning:
  Implement and operate automated security testing within those pipelines, including static analysis (SAST), dependency analysis (SCA), secret detection, dynamic testing (DAST), vulnerability scanning and SBOM generation, with quality gates and clear, consolidated reporting.
• Vulnerability Management:
  Triage scanner findings and newly published CVEs with the development teams, assess their real impact on our products, track remediation through to release, and support regular security patch releases.
• Compliance & Hardening:
  Help CRFS meet customer and regulatory security requirements (e.g. NIST SP 800-53, DISA STIGs, FIPS 140) by hardening our Linux-based product images and servers, and producing the repeatable scan results and technical evidence needed for system certification.
• Build Infrastructure:
  Maintain and secure the build estate, including self-managed Git Lab and Team City, Linux and Windows build agents, virtualized and cloud infrastructure, and internal package mirrors, using infrastructure-as-code where practical.
• Supply Chain Security:
  Protect the integrity of what we ship through dependency pinning and vetting, trusted internal mirrors, artifact and release signing, access reviews, and careful management of secrets, keys and tokens.
• Code Review:
  Review pipeline, infrastructure and application changes written by other engineers, providing constructive feedback and ensuring alignment with security standards.
• Documentation:
  Write clear runbooks, developer guides and security documentation to support system certification, in line with the CRFS Quality Management System.

• Relevant
  
  Experience:
  
  Three or more years in a Dev Ops, Dev Sec Ops , build/release or platform engineering role, or equivalent CI/CD-focused software engineering experience.
• Linux:
  Strong hands-on experience administering and securing Linux systems (Ubuntu/Debian), including shell scripting and networking fundamentals.
• CI/CD:
  Practical experience building and maintaining pipelines in Git Lab CI, Team City, Jenkins, Git Hub Actions or similar.
• Automation:
  Proficiency in Python and Bash for automation and tooling, with a commitment to clean, maintainable code under version control (Git).
• Containers:
  Working knowledge of Docker, including writing Dockerfiles, managing images and registries, and running builds in containers.
• Security Fundamentals:
  Hands-on exposure to security tooling in a development pipeline (e.g. SAST, dependency or vulnerability scanning), the ability to interpret a CVE and judge its real impact, and a sound grasp of least privilege, secrets management and patching.
• Problem Solving: A methodical approach to diagnosing build, infrastructure and security problems across unfamiliar codebases and systems.
• Collaboration:
  
  Clear written and verbal communication, able to explain security findings constructively and to own assigned work through to completion.

• Regulated Environments:
  Experience working to…