Expert DevSecOps Engineer (Expert Software Development Security Engineer)

Madrid, Community of Madrid, SpainPosted 2 months agoWebsite

Apply on LinkedIn →

At a Glance

DevSecOps

About This Role

Expert DevSecOps Engineer position at Roche in Madrid, Spain. This role involves supporting Product and Application teams across the SDLC, mentoring junior engineers, and contributing to software-security frameworks and automated guardrails. The position is part of Roche's security-by-design-and-default approach, integrating cybersecurity throughout the product lifecycle.

About Roche

Roche, officially known as F. Hoffmann-La Roche AG, is a Swiss multinational healthcare company founded in 1896 and headquartered in Basel, Switzerland. As the world's largest biotechnology firm, Roche operates globally, providing innovative medicines and diagnostic solutions across major disease areas. The company is recognized as a leader in cancer treatments and is ranked as the fifth-largest pharmaceutical company by revenue. Roche operates through two main divisions: Pharmaceuticals and Diagnostics. The Pharmaceuticals division focuses on developing breakthrough medicines in areas such as oncology, immunology, infectious diseases, and neuroscience. The Diagnostics division offers a comprehensive range of in-vitro diagnostic tools, including automated systems for blood and tissue analysis, as well as solutions for diabetes management. Roche also integrates digital health technologies to enhance patient care and personalize treatment. With a commitment to addressing healthcare challenges, Roche serves a diverse customer base, including hospitals, healthcare providers, and patients in over 100 countries.

Industry

research

Employees

103,000

7119 engineers

Revenue

$77B

Website

Visit →

Security at Roche

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

Roche publicly states a security-by-design-and-default approach, integration of cybersecurity throughout the product lifecycle, threat-based risk assessment beginning during design, extensive pre-release testing, and continuous post-deployment vigilance.
Its public materials also describe security as part of patient safety, privacy, quality, and trust.
Roche states that it grows information-security capabilities in-house rather than outsourcing the majority of the function.
The public record describes security enablement through self-service DevSecOps components, automated guardrails, and cross-functional support for Product and Application teams. It also describes cybersecurity champions at sites as a bridge between technical and business teams. Company statements are.

Security Team

Roche's publicly documented software-security organization includes an Embedded Security & Testing Team within Engineering Excellence & Experience (E3), plus a Code Quality, Security, and Testing Engineering team.
The DevSecOps role supports Product and Application teams across the SDLC and mentors junior engineers.
Publicly identified leaders include Tim Ehrhart, Domain Head of Information Security.
Jonathan Sinclair, Head of Cybersecurity for Roche Pharma Technical Operations.
Bill O'Connell, Head of Product Security & Privacy Operations.
At least two current AppSec/DevSecOps practitioners are publicly identifiable.
Directly relevant public postings as of: 2—Expert DevSecOps Engineer and Cybersecurity Analyst Intern.
Common patterns include threat modeling, SAST, SCA, secret scanning, IaC scanning, container scanning, API security, dependency management, automated CI/CD guardrails, self-service enablement, and cross-functional developer support.
Claims based on company materials are .
Profile details are.

Key Initiatives

Security champions: Evidence Found. Jonathan Sinclair's public interview describes cybersecurity champions at various sites as helping bridge technical teams and business objectives; detailed program structure and ownership are not publicly available. Shift-left: Roche describes integrating security and testing throughout the SDLC, automated SAST/SCA/container-scanning guardrails in DevOps workflows, and a current SDET posting requiring automated SAST/DAST analysis. Vulnerability intake: Roche accepts reports from intrusion-protection and detection systems, industry information, employees, customers, and external actors; Diagnostics also accepts reports through security@roche.com. Triage and remediation: Roche states that confirmed findings are acknowledged, assigned a contact person, assessed for risk, assigned a CVE where applicable, and published; product teams analyze root cause and implement fixes or patches. Severity-based playbooks and coordinated communications are described. Secure-SDLC artifacts include threat modeling, risk assessments, penetration testing, vulnerability assessments, code-quality controls, dependency management, license compliance, IaC scanning, container-image scanning, API security, and runtime scanning. Recent public activity within six months includes the July 2026 Expert DevSecOps posting for software-security frameworks and automated guardrails, the August 2026 cybersecurity analyst posting for product vulnerability analysis using automation and AI, and the August 2026 SDET posting for shift-left SAST/DAST automation. These postings document responsibilities and requirements, not confirmed production rollouts. Company statements are

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on LinkedIn