DevSecOps Specialist (regular/senior) (She/He/They)

The Cyber Security team, part of Accenture Security, supports organizations in building secure, resilient, and scalable security capabilities across complex enterprise technology landscapes — integrating security into software development, cloud adoption, digital transformation, and technology modernization so that security by design and security by default are reflected in how systems are actually built and operated, not only in policy. 

We act as trusted advisors to some of the world's leading organizations, helping them define pragmatic security operating models, improve security maturity, and align cybersecurity capabilities with their business and technology objectives. Working at the forefront of the industry means constant exposure to complex, high-stakes security challenges and the latest technologies — across banking, manufacturing, healthcare, retail, and public sector, each with its own regulatory context and technical scale. 

As part of a global security leader, you work on engagements that span the full breadth of modern enterprise security — from securing AI-enabled systems and cloud-native architectures to embedding security into large-scale digital transformation programmed. The variety of clients, industries, and technology stacks means you are continuously challenged, and the depth of expertise around you means you are never navigating that alone.

We are looking for candidates with a solid foundation across the areas below. Hands-on experience and a working grasp of the core concepts is the baseline — specialization and depth can be developed from there. 

•  A real engineering or IT background. Several years in IT, DevOps, platform engineering, or a related role. You have built, run, or automated systems, and you know what breaks in production because you have been there when it did. 

• Security fundamentals you understand rather than memorized. Confidentiality, integrity, and availability — what they mean for a running system and what breaks them. How applications get attacked: SQL injection, XSS, CSRF, and the classes of problem behind the OWASP Top 10. What encryption, hashing, and secrets management are for and how people misuse them. If you can explain to a developer why a control exists, that is what we mean. 

• Hands-on experience with CI/CD pipelines. At least one system — Azure DevOps, GitLab CI, Jenkins, GitHub Actions, Argo CD, or similar. You have built or maintained pipelines rather than only read about them, and Git is a daily tool rather than a concept. 

• Experience with one public cloud. Azure, GCP, or AWS. One, used in earnest, is worth more here than three from a slide. 

• A basic understanding of containers and orchestration. Docker, and Kubernetes or OpenShift at the level of knowing how a workload gets scheduled, exposed, and given credentials. 

• Enough code to automate and to review. Scripting you can actually write — Python, Bash, or similar — and the ability to read someone else's Java, C#, JavaScript, or Go well enough to reason about what it does and where it goes wrong. You do not need to be a professional developer today. 

• Language requirements. Professional proficiency in both English and Polish is required. English is the primary language for client-facing work — including findings communication, workshop facilitation, and presentations to senior stakeholders. Polish is the language of day-to-day team operations. Proficiency in both is a non-negotiable requirement for this role. 

• Ways of working. Strong communication skills, including the ability to translate complex technical findings into clear, actionable recommendations for non-technical audiences. Curiosity and adaptability — comfortable reading unfamiliar documentation, prototyping something rough to see if it works, and being the person expected to define what "good" looks like in a domain you met three weeks ago. A proactive, ownership-oriented mindset, given the pace of change in the DevSecOps landscape. 

Seniority levels 

Regular (approximately 2–5 years of relevant experience). Candidates at this level are expected to independently deliver defined workstreams — building and securing pipelines, integrating and tuning scanning tools, reviewing deployments and cloud configuration, and communicating findings to client technical teams. A working knowledge of the OWASP Top 10 and secure coding principles is expected, with continued development across the broader requirements list. 

Senior (approximately 5+ years of relevant experience). Candidates at this level are expected to lead workstreams, provide technical direction, and mentor junior colleagues. This requires demonstrated depth in at least one domain — cloud platform security, pipeline and automation engineering, containers, API and application security, or AI security — alongside sufficient breadth to engage credibly across all areas and present confidently to senior client stakeholders. 

Research indicates that some candidates, especially the most diverse ones, may hesitate to apply for positions if they don't meet all requirements. If you believe you possess the necessary skills, even if not meeting every requirement, we wholeheartedly encourage you to submit your application.
 

Years of experience are provided as guidance only and are not a strict eligibility criterion. Candidates transitioning from development, platform engineering, SRE, or in-house security roles are encouraged to apply — if you can demonstrate the relevant skills and hands-on experience, we will work out where you fit. Seniority is assessed based on demonstrated capability during the interview process, not determined at the CV screening stage. 

Any one of these is a plus, and we value the individual experience you bring over the number of lines you tick. For a Regular role none of them is required. For a Senior role we expect real depth in at least one. 

• Practical experience with SAST, DAST, and SCA tools and integrating them into CI/CD pipelines so that the pipeline stays fast enough that nobody wants to bypass it. 

• DevSecOps tooling from vendors such as Snyk, WIZ, IriusRisk, CrowdStrike, Aqua Security, Checkmarx, OpenText, Veracode, or Argo CD. 

• Authentication, authorisation, and session management — SAML, OAuth, SSO, and how identity actually gets wired into an application. 

• SSDLC processes end to end, and the ability to integrate security into DevOps pipelines rather than alongside them. 

• REST API technology and API Gateway concepts, and application and API security principles across secure design, development, and deployment. 

• Conducting security reviews of API designs, source code, and deployments — and implementing API security platforms and monitoring solutions. 

• Threat modelling, with mitigation strategies robust enough to survive contact with a delivery schedule. 

• Web application security frameworks and taxonomies in practice: OWASP Top 10, secure coding practice, and MITRE. 

• Infrastructure as Code and configuration management: Terraform, Ansible, or similar. 

• Foundational knowledge of AI model architectures — memory context, prompt engineering, and integration with external services — and awareness of AI-related security risks such as prompt injection, data leakage, and model misuse. 

• Building and integrating solutions using Large Language Models — Azure OpenAI, LangChain, REST APIs, embeddings, vector databases. 

• Writing scripts, prototypes, and micro-applications to solve a problem quickly, alongside good working knowledge of at least one programming language — Java, .NET/C#, JavaScript, Go, or Python. 

• Prior consulting or client-facing experience. 

• A development, platform engineering, SRE, or in-house security background. 

• Security or cloud certifications — we care about what you can do, and we co-finance certifications once you are here.