Lead Engineer – GitHub Enterprise Platform (Administration, Policy & Security)

We have an urgent requirement for Lead Engineer – GitHub Enterprise Platform (Administration, Policy & Security) in Banking Domain for one of our banking client in Abu Dhabi, UAE

• Own and administer the GitHub Enterprise Cloud environment, including organization management, access control, SSO/SCIM integration, repository governance, and onboarding. --Must
• Define and enforce enterprise security and governance policies, including repository rulesets, branch protection, least-privilege access, managed-device controls, and GitHub Copilot governance. --Must
• Manage GitHub Advanced Security, vulnerability remediation, audit log monitoring, SIEM integration, incident response, and software supply-chain security initiatives. --Must
• Drive secure CI/CD practices using GitHub Actions, AKS-based self-hosted runners, SLSA Level 3 controls, artifact signing, policy-as-code, and compliance with banking and regulatory standards--Must

Required within 6 months: GitHub Administration; GitHub Advanced Security.—-Certificate Must

Banking domain --Must

Role Purpose

The role owns the bank's GitHub Enterprise Cloud estate end to end: enterprise and organisation administration,security and access policy, and the governance of the CI/CD supply chain. The goal is a developer platform that ~300 engineers can use with low friction, while meeting regulatory, audit and SLSA Build Level 3 requirements.

Platform context

The successful candidate will join an active build-out, not a steady-state platform. Current landscape: Source control:

GitHub Enterprise Cloud (GHEC), ~300 engineers, multiple organisations. Page 1 of 7JD – GitHub Enterprise Platform Administrator (Policy, Security & Governance) Identity: Microsoft Entra ID as the bank IdP, with SAML/OIDC SSO into GitHub Enterprise. Endpoints: Bank-managed macOS laptops under Jamf; GitHub access is to be restricted to managed devices only, and personal access tokens (PATs) blocked.

Build runners: Ephemeral self-hosted GitHub Actions runners (Actions Runner Controller) on a private AKS cluster with no internet egress, building React front ends and Spring Boot services.

Supply Chain Target

SLSA Build Level 3 – isolated, ephemeral builds with signed provenance and artifact attestations.

Security Tooling

GitHub Advanced Security, SonarQube Cloud, Trivy, Microsoft Defender, CrowdStrike Falcon.

Enterprise artifact repository (JFrog Artifactory or Sonatype Nexus, decision in progress), hosted on Azure, serving on-prem and cloud.

Runtime Estate

Azure and AWS (eu-west-1), with a planned on-prem OpenShift platform. Artifacts:

Key Responsibilities

• Enterprise administration Own the GHEC enterprise account: organisations, teams, enterprise roles, billing, licence allocation and seat reclamation.Manage identity integration with Entra ID: SSO, SCIM provisioning and deprovisioning, group-to-team mapping, joiner-mover-leaver automation.Define the repository model: naming, visibility, templates, CODEOWNERS, custom properties and archival rules.Administer GitHub Apps, OAuth apps and marketplace actions through an approval and allow-list process.Run onboarding for new squads and vendors, including time-bound access for thirdparty developers.
• Policy and governanceDefine and enforce enterprise policies: repository rulesets, branch and tag protection, required reviews, signed commits and required status checks.Enforce least privilege: base permissions, custom repository roles, quarterly access recertification.Restrict access to managed devices: IP allow lists, conditional access with Entra ID and Jamf device compliance, PAT restriction or blocking, SSH certificate authorities.Govern GitHub Actions: allowed actions list, workflow permissions defaults, OIDC federation to Azure and AWS instead of stored secrets, runner group scoping.Govern GitHub Copilot and other AI coding tools: policy settings, content exclusions and usage reporting.Maintain policy-as-code, so that settings are versioned, peer-reviewed and auditable.
• SecurityRun GitHub Advanced Security: CodeQL code scanning, secret scanning with push protection, Dependabot, dependency review and security campaigns.Integrate GHAS findings with SonarQube Cloud, Trivy and the bank's vulnerability management process; track remediation SLAs.Stream enterprise audit logs to the bank SIEM (for example Microsoft Sentinel) and build detections for risky events: visibility changes, admin grants, policy bypass, mass cloning.Respond to GitHub-related security incidents: leaked secrets, compromised tokens, malicious actions or dependencies.Contribute to threat models (STRIDE) for the developer platform and CI/CD pipeline.
• CI/CD supply-chain security:

Operate ephemeral self-hosted runners (ARC) on private AKS with no internet egress, working with the Cloud CoE.Deliver SLSA Build Level 3 controls: isolated builds, build provenance, artifact attestations and signing (Sigstore/cosign).Integrate GitHub with the enterprise artifact repository as the only source of dependencies and the only destination for build outputs.Publish reusable workflows and golden-path templates for React and Spring Boot builds with security gates built in.

• Compliance and audit: Map platform controls to CBUAE regulations, UAE Information Assurance Standards, PCI DSS and ISO 27001.Produce audit evidence on demand: access reviews, policy state, change history and segregation of duties. Keep runbooks, standards and platform documentation current;act as the owner for internal and external audit findings on the platform.
• Developer enablement: Act as the GitHub subject-matter expert for ~300 engineers; run office hours and training.Measure and reduce friction: build times, queue times, false-positive rates on security gates.Track GitHub roadmap changes and assess their impact on bank policy.

Essential

Qualifications and skills:

Bachelor's degree in Computer Science, Engineering or equivalent experience.7+ years in DevOps, platform or security engineering, with 3+ years administering GitHub Enterprise (Cloud preferred) at enterprise scale.Hands-on with GHEC enterprise settings, rulesets, custom roles, audit log streaming, GitHub Apps and the REST/GraphQL APIs.Strong Entra ID integration experience: SAML/OIDC SSO, SCIM, conditional access; Enterprise Managed Users (EMU) is a plus.GitHub Actions in depth: reusable workflows, OIDC to Azure/AWS, Actions Runner Controller on Kubernetes (AKS).GitHub Advanced Security: CodeQL, secret scanning, push protection, Dependabot, security overview. Software supply-chain security: SLSA, provenance, Sigstore/cosign, SBOMs, artifact repositories (Artifactory or Nexus). Automation in Terraform plus one of Python, Go or Bash; policy-as-code practices.Experience in a regulated industry, ideally banking or financial services.

DesirableWorking knowledge of CBUAE technology risk requirements, UAE IA Standards, PCI DSS and ISO 27001.

SIEM integration and detection engineering (Microsoft Sentinel or similar).Air-gapped or no-egress build environments:dependency mirroring, base image management.Jamf or Intune device compliance integration.Governance of GitHub Copilot or other AI coding assistants. Exposure to OpenShift, Kong or HashiCorp Vault.

Certifications

Required within 6 months: GitHub Administration; GitHub Advanced Security.Preferred: GitHub Actions, CKA, AZ-500 or AZ-400, CISSP or CCSP.

Skills: github,security,policy