Senior DevSecOps Engineer Contract

Job description

Working at CreateFuture CreateFuture is an AI-native consulting partner where people do work that matters and are supported to do it well. We work alongside organisations such as PayPal, adidas, NatWest, FanDuel and Money Saving Expert, building digital products and services that make a difference while always putting people first. We’re a team of creators. We write code, shape delivery, build go-to-market strategies, develop AI solutions and create the practices that support our people. We work side by side with our clients, challenging what’s not working and helping them to build the future. Our commitment to craft, quality, and culture has helped us scale to over 600 people in just a few years. Our UK Benefits 35 days leave (including bank holidays). Private medical insurance. Enhanced parental and adoption leave. Financial coaching + 5% pension match. 40 hours of paid learning and development. View our full list of UK benefits. CreateFuture is a Great Place to Work-Certified™ company and has won Best Workplaces UK multiple years in a row. Join us on our journey. Let’s create tomorrow, together, today. We are looking for an experienced senior DevSecOps Engineer to join our growing Security practice. In this role you will drive Platform and application security across client engagements — embedding security thinking into every stage of the SDLC, mentoring engineers, and helping CreateFuture build world-class DevSecOps capabilities. Our clients span regulated and high-stakes industries including iGaming, healthcare-tech, e-commerce, and financial services. You will work hands-on with these clients — conducting threat modelling, secure architecture reviews, and penetration testing — while also shaping the internal AI-powered security tooling that sets CreateFuture apart. Key Responsibilities Cloud Security – Design and implement security controls across Azure using Terraform (including Azure Entra ID, PIM, CAP, Policy Defender, and Sentinel). Application Security – Incident Response plans, design and implement SAST, DAST, IaC, Container scans with industry-standard tools and deal with common issues such as False Positive rates. Threat Modelling & Secure Design – Lead threat modelling sessions and carry out secure architecture and code reviews on client engagements, including within regulated iGaming environments. Penetration Testing – Perform white-boxed ap…