Deputy General Manager – Software Defined Vehicle (SDV)l DevSecOps Lead

Purpose of the Role

The Deputy General Manager – SDV DevSecOps Lead owns the CI/CD/CT strategy, pipeline architecture, and security posture across all software layers of the Software Defined Vehicle: onboard embedded firmware and AAOS, through to cloud backend services. The role defines and governs enterprise-grade DevSecOps frameworks — integrating SAST, SCA, DAST, binary security assessment, and SBOM-first delivery — and translates ASPICE, ISO/SAE 21434, and UNECE R155/R156 obligations into automated pipeline controls. The DGM leads a multi-disciplinary DevOps and security engineering team, acts as the primary interface to OEM programme heads and Tier-1 partners, and is accountable for delivery quality and regulatory compliance across all SDV programmes.

Job Responsibility

Platform Strategy & CI/CD/CT Architecture

•Define the DevSecOps technology roadmap covering all SDV software layers — ECU/MCU firmware, AAOS, and cloud microservices — and own the enterprise CI/CD/CT reference pipeline framework.

•Architect mandatory security gate policy: SAST, SCA, DAST, and binary hardening checks with defined failure thresholds, waiver governance, and SBOM generation as a first-class release artefact.

•Drive pipeline-as-code and GitOps adoption; govern artefact management, branching strategy, release train cadence, and toolchain selection across programme teams.

•Oversee HIL/SIL integration within the CI pipeline and the full OTA release chain: binary signing, delta generation, manifest creation, and SUMS compliance verification.

DevSecOps Governance & Security Integration

•Embed security controls at every pipeline stage for the full onboard-to-offboard SDV stack; enforce zero-exception security gate policy across all release streams.

•Govern SAST/SCA/DAST toolchain selection and CVE lifecycle management — SBOM-correlated ingestion, severity SLA enforcement, and closure tracking within the programme CSMS register.

•Direct binary security assessments of ECU firmware, OTA packages, and IVI APKs; collaborate with Cybersecurity Architecture to close the loop between TARA outputs and automated pipeline controls.

•Operationalise UNECE R155/R156, ISO/SAE 21434, and ASPICE obligations as pipeline policy; own audit evidence packages for homologation and regulatory assessments.

OEM & Supplier Ecosystem Management

•Serve as the DevSecOps interface to OEM programme management; present pipeline maturity, security posture, and release readiness at programme steering reviews.

•Define and enforce DevSecOps acceptance criteria for Tier-1/Tier-2 software deliverables; conduct supplier pipeline integration reviews and audit binary security baselines.

•Negotiate toolchain and process requirements with OEM customers on customer-funded development programmes; govern cross-organisation traceability linkages in the ALM toolchain.

Organisation Leadership

•Build and lead a cross-functional team of DevOps, release, and security automation engineers; define the capability roadmap and drive targeted hiring and upskilling.

•Establish a DevSecOps centre of excellence — reference architectures, pipeline templates, and internal training — consumed by all SDV programme teams.

•Foster a culture of engineering rigour: measurable pipeline quality gates, blameless post-mortems, and systematic knowledge-sharing across programme boundaries.

Desired Candidate Profile

Education & Experience

•B.E. / B.Tech in Computer Science, Electronics, or Information Technology; M.E. / M.Tech preferred. Advanced DevOps or security certifications (CKA, CISSP, GitLab Professional) desirable.

•Minimum 12 years of software engineering experience with at least 4 years leading a DevOps, platform engineering, or DevSecOps function in an automotive OEM or Tier-1 environment.

•Demonstrated ownership of CI/CD/CT strategy spanning embedded (Yocto / AAOS) and cloud workstreams, with direct OEM customer or programme delivery exposure.

Technical Expertise

•Strong expertise in enterprise CI/CD toolchains: Jenkins, GitLab CI/CD, GitHub Actions, ArgoCD; containerised build environments (Docker, Kubernetes); Yocto SDK pipeline integration.

•Hands-on experience with DevSecOps tooling: SAST (Coverity, Semgrep), SCA (Black Duck), DAST (OWASP ZAP); binary analysis (checksec, Binwalk, LIEF); SBOM generation (CycloneDX / SPDX).

•Deep understanding of automotive cybersecurity standards (ISO/SAE 21434, UNECE R155/R156, ASPICE); familiarity with secure OTA, PKI, and onboard-to-cloud security architecture.

•Proficiency in Python and Bash for pipeline automation and internal tooling; experience with ALM platforms (Jira, Confluence, Bitbucket) and observability stacks (Grafana, Prometheus).