DevOps Infrastructure Engineer - RDT China Enterprise Technologies
Roche · Shanghai
At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.
The Position
Job Description
As a DevOps Infrastructure Engineer at the SE7 level, you will be responsible for solving unusually complex business problems with innovative DevOps and cloud infrastructure solutions across the entire platform landscape . Operating with considerable independence, you will establish the technical direction for the entire lifecycle of our platforms—from inception and design through deployment, operations, security, and retirement.
In this role, you will build a secure, self-service Internal Developer Platform (IDP) that abstracts away infrastructure complexity while enforcing rigorous compliance, cloud security AIOps, and proactive threat mitigation across both cloud-native environments and AI agent platforms.
Key Responsibilities
1. Cloud Security Operations & AIOps
- Vulnerability & Patch Automation: Drive continuous monitoring of cloud server OS vulnerabilities and design fully automated OS patching pipelines/toolsets to rapidly mitigate risks across the infrastructure landscape.
- Hardened Image Lifecycle: Author and maintain gold-standard cloud server AMIs (OS) utilizing an Infrastructure-as-Code (IaC) approach (e.g., Terraform, Ansible, Packer) .
- Continuous Security Monitoring: Manage and optimize Cloud Security Hub and Security Center platforms. Take responsibility for landing zone security alert handling, triaging, and remediation.
- Endpoint & Key Security: Oversee the deployment and continuous maintenance of endpoint security agents (including Cortex XDR and Nessus agents), and optimize Cloud Key Management Services (KMS) for robust data encryption.
- AIOps & Security Assessments: Pioneer cloud security AIOps to predict, detect, and automatically remediate security anomalies. Lead comprehensive cloud platform security assessments and continuous refinement strategies.
2. DevOps Engineering & Adoption
- Secure Software Supply Chain: Lead the adoption, support, and integration of the DevOps toolchain across all automated CI/CD pipelines , spanning threat modeling, SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), SCA (Software Composition Analysis), and runtime security monitoring.
- Container & Orchestration Security: Lead Kubernetes cluster hardening, establishing fine-grained network policies, container runtime security, and secure configuration baselines.
- Centralized Secret Vaulting: Establish and enforce unified secret management protocols across all application environments using centralized secret and credential vaulting solutions.
3. AI Agent Security & Safeguards
- Agent IAM & Identity Management: Design and implement robust Identity and Access Management (IAM) frameworks specifically tailored for autonomous AI agents, including identity and secret management for agent plugins and external tools.
- Continuous Guardrails & Monitoring: Architect and maintain continuous agent guardrails and runtime monitoring systems to trace, evaluate, and restrict agent reasoning and actions within safe boundaries.
- Model & Database Safeguards: Ensure model artifact security and establish strict integration safeguards for databases, ADP, and Vector/Graph Databases (VectorDB) to prevent data exfiltration and unauthorized access.
- Active Defense & Hardening: Implement automated prompt red-teaming pipelines to proactively discover LLM vulnerabilities, and lead code execution sandbox hardening to run agent-generated code safely.
4. Platform Engineering & Excellence
- Platform Engineering: Lead automation tools design and implementation to optimize the Cloud security operation. You will turn security requirements into technical design and lead the development team to deliver it.
- Audit,Compliance : Ensure all cloud and AI environments strictly adhere to enterprise Quality/Regulatory standards . Lead complex audit exercises, provide audit evidence, author remediation plans, and design end-to-end disaster recovery (DR) strategies
Qualifications & Technical Skills
- Experience: 5+ years of experience as an Infrastructure, DevOps, or Security Engineer , with at least 2+ years of hands-on experience designing secure AI architectures or Agentic platforms. Experience in the pharmaceutical, life sciences, or top-tier tech industries is highly preferred.
- AI Agent Security Mastery: Proven experience with agent runtimes, prompt security, sandbox design, VectorDB integrations, and managing credentials/identities for plugins and external MCPs/APIs.
- DevOps & Kubernetes Hardening: In-depth technical knowledge of security toolchains (SAST/DAST/SCA), Kubernetes cluster hardening, container runtime security, and credential vaulting solutions.
- Cloud Operations & IaC: Mastery of Infrastructure-as-Code (Terraform, CloudFormation) for managing cloud environments . Proven track record of OS hardening, AMI baking, endpoint agent maintenance (Cortex XDR, Nessus), and Cloud Security Hub automation.
- Hands-on Engineering: Highly proficient in at least one backend development or scripting language (e.g., Python, Go) with deep expertise building automated, secure CI/CD pipelines (GitLab/GitHub, JFrog) .
- Compliance & Audit Leadership: Strong ability to translate complex corporate policies and regulatory standards into technical controls, lead audit exercises, and manage incident responses .
- Language: Fluent bilingual capabilities in both English and Mandarin, enabling seamless collaboration across global and local cross-functional teams.
#RDT 2026
Who we are
A healthier future drives us to innovate. Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.
Let’s build a healthier future, together.
Roche is an Equal Opportunity Employer.