Deputy General Manager – Software Defined Vehicle (SDV)l DevSecOps Lead

Purpose of the Role The Deputy General Manager – SDV DevSecOps Lead owns the CI/CD/CT strategy, pipeline architecture, and security posture across all software layers of the Software Defined Vehicle: onboard embedded firmware and AAOS, through to cloud backend services. The role defines and governs enterprise-grade DevSecOps frameworks — integrating SAST, SCA, DAST, binary security assessment, and SBOM-first delivery — and translates ASPICE, ISO/SAE 21434, and UNECE R155/R156 obligations into automated pipeline controls. The DGM leads a multi-disciplinary DevOps and security engineering team, acts as the primary interface to OEM programme heads and Tier-1 partners, and is accountable for delivery quality and regulatory compliance across all SDV programmes.

Job Responsibility

Platform Strategy & CI/CD/CT Architecture •Define the DevSecOps technology roadmap covering all SDV software layers — ECU/MCU firmware, AAOS, and cloud microservices — and own the enterprise CI/CD/CT reference pipeline framework. •Architect mandatory security gate policy: SAST, SCA, DAST, and binary hardening checks with defined failure thresholds, waiver governance, and SBOM generation as a first-class release artefact. •Drive pipeline-as-code and GitOps adoption; govern artefact management, branching strategy, release train cadence, and toolchain selection across programme teams. •Oversee HIL/SIL integration within the CI pipeline and the full OTA release chain: binary signing, delta generation, manifest creation, and SUMS compliance verification. DevSecOps Governance & Security Integration •Embed security controls at every pipeline stage for the full onboard-to-offboard SDV stack; enforce zero-exception security gate policy across all release streams. •Govern SAST/SCA/DAST toolchain selection and CVE lifecycle management — SBOM-correlated ingestion, severity SLA enforcement, and closure tracking within the programme CSMS register. •Direct binary security assessments of ECU firmware, OTA packages, and IVI APKs; collaborate with Cybersecurity Architecture to close the loop between TARA outputs and automated pipeline controls. •Operationalise UNECE R155/R156, ISO/SAE 21434, and ASPICE obligations as pipeline policy; own audit evidence packages for homologation and regulatory assessments. OEM & Supplier Ecosystem Management •Serve as the DevSecOps interface to OEM programme management; present pipeline maturity, security posture, and release readiness at programme steering reviews. •Define and enforce DevSecOps acceptance criteria for Tier-1/Tier-2 software deliverables; conduct supplier pipeline integration reviews and audit binary security baselines. •Negotiate toolchain and process requirements with OEM customers on customer-funded development programmes; govern cross-organisation traceability linkages in the ALM toolchain. Organisation Leadership •Build and lead a cross-functional team of DevOps, release, and security automation engineers; define the capability roadmap and drive targeted hiring and upskilling. •Establish a DevSecOps centre of excellence — reference architectures, pipeline templates, and internal training — consumed by all SDV programme teams. •Foster a culture of engineering rigour: measurable pipeline quality gates, blameless post-mortems, and systematic knowledge-sharing across programme boundaries.