DevOps Infrastructure Engineer - AI Agent Security & Cloud Platforms

About the role

Roche is hiring a DevOps Infrastructure Engineer (SE7 level) in Shanghai for its RDT China Enterprise Technologies unit. The engineer solves complex business problems with DevOps and cloud infrastructure solutions across the platform landscape, sets the technical direction for the full lifecycle of platforms (design, deployment, operations, security, retirement), and builds a secure, self-service Internal Developer Platform (IDP) that enforces compliance, cloud security, AIOps and proactive threat mitigation across cloud-native and AI agent platforms.

Key responsibilities

• Cloud security operations and AIOps: automate vulnerability monitoring and OS patching, maintain hardened cloud server AMIs with IaC (Terraform, Ansible, Packer), manage Cloud Security Hub and Security Center, handle security alerts, deploy endpoint agents (Cortex XDR, Nessus) and optimize KMS
• DevOps engineering and adoption: integrate the DevOps toolchain into CI/CD pipelines with threat modeling, SAST, DAST, SCA and runtime security; harden Kubernetes clusters, set network policies and secure baselines; centralize secrets and credentials
• AI agent security: design IAM for AI agents and their plugins, build guardrails and runtime monitoring, protect models and databases, and run automated prompt red-teaming and sandbox hardening
• Platform engineering and compliance: turn security requirements into technical designs, lead audits, provide audit evidence, write remediation plans and design end-to-end disaster recovery strategies

Required profile

• 5+ years as an Infrastructure, DevOps or Security Engineer, with at least 2+ years designing secure AI architectures or agentic platforms
• Experience in pharmaceutical, life sciences or top-tier tech is highly preferred
• Fluent bilingual English and Mandarin

Required skills

• Infrastructure-as-Code (Terraform, CloudFormation) and OS hardening, AMI baking, endpoint agent maintenance, Cloud Security Hub automation
• SAST/DAST/SCA, Kubernetes hardening, container runtime security and secret vaulting
• Backend or scripting language such as Python or Go, with automated CI/CD pipelines (GitLab, GitHub, JFrog)
• Agent runtimes, prompt security, sandbox design, VectorDB integrations and credential management for plugins and APIs