DevOps, Security & GRC Engineer

About BlackEdge Labs BlackEdge Labs is the technology and innovation arm of BlackEdge, a growing publicly traded financial group operating across mortgages, payments, and corporate financing. We build the software, data, AI, and digital platforms that support the Group’s operations, growth, and future financial solutions, combining deep technological expertise with a practical, business-oriented approach. About the role We’re looking for a DevOps, Security & GRC Engineer: a hands-on DevOps engineer who owns the security and compliance layer of our cloud platform. This is a DevOps role first. You’ll build and run infrastructure as code, CI/CD pipelines, and cloud environments on Azure, and use that foundation to turn security policy and regulatory requirements into enforced, measurable, continuously monitored controls. You’ll work closely with the CISO, the organization’s GRC stakeholders, and the engineering teams, bridging platform engineering and governance. The goal: every environment deployed from code, every security baseline enforced automatically, and a reliable, real-time, organization-wide view of security and compliance posture. What you’ll be doing DevOps and platform engineering Own infrastructure as code on Azure: design, build, and maintain Terraform modules, state management, and multi-environment deployments (dev / test / prod). Build and operate CI/CD pipelines in GitHub Actions and Azure DevOps, including automated infrastructure deployment and approval gates between environments. Work GitOps-style: every infrastructure change goes through Git, pull requests, and code review, with continuous drift detection against deployed resources. Run and improve production cloud environments: networking, containers, observability, and reliability. Security engineering (DevSecOps) Enforce security baselines at deployment time with Azure Policy definitions, Terraform guardrails, and pipeline templates. Build security into the pipelines: secret, dependency, container, and IaC scanning, with findings blocking promotion between environments. Harden identities and access: RBAC, least privilege, PIM/PAM, service accounts, and workload identities, monitored against approved baselines. Define security baselines for Azure, Microsoft 365, SaaS applications, data protection, network, and endpoints. GRC and compliance automation Translate security policies and regulatory requirements into measurable technical controls. Develop API-based automations and integrations that collect evidence from security systems into a centralized control platform, and build and operate that platform’s own infrastructure. Continuously monitor policy compliance, detect gaps between policy and implementation in real time, and track remediation with system owners. Build KPIs, KRIs, and management dashboards that give leadership a reliable, organization-wide view of security and compliance posture. What you’ll need At least 4 years of hands-on DevOps or Cloud Engineering experience, building and running production cloud infrastructure. This is a must; the role is built on it. Strong Terraform experience: module design, state management, and multi-environment deployments. Experience building and maintaining CI/CD pipelines in GitHub Actions or Azure DevOps, including automated deployment of cloud infrastructure. Experience operating production environments in Azure (preferred), AWS, or GCP, including cloud networking, containers, and application security. Proven Python development experience, plus PowerShell or Bash scripting, and experience with REST APIs and system integrations. Hands-on identity and access management: RBAC, least privilege, PIM, PAM, and access governance. Security engineering experience: cloud security baselines, security scanning in pipelines, and DevSecOps tooling. A solid understanding of security controls, governance, compliance, and risk management (GRC), and the ability to translate business and regulatory requirements into measurable technical controls. Nice to have Microsoft stack: Entra ID, Microsoft 365, Microsoft Graph API, Defender, Sentinel, Azure Policy, and Azure Landing Zones. DevSecOps tooling such as Defender for Cloud, GitHub Advanced Security, Checkov, tfsec, or Trivy. GitOps experience (Flux or Argo CD) and running Kubernetes / AKS in production. CSPM/SSPM platforms or Identity Governance solutions such as Entra ID Governance, SailPoint, or Saviynt. Development experience in C#/.NET or Java. Familiarity with SOC operations, data protection and DLP, network security, or endpoint security. Certifications such as HashiCorp Certified: Terraform Associate, AZ-400, or AZ-500. Experience in a financial or regulated environment. Ready to build the technology layer that connects security policy, regulation, and security systems within a growing publicly traded financial group? We’d love to meet you. This is a full-time, office-based position at our Tel Aviv office. The position is open to candidates of all genders. Please send your CV to careers@blackedge.co.il .