Senior DevOps / Release Engineer
Trend Micro · Austin, United States
TrendAI™, the global AI security leader and enterprise business unit of Trend Micro, empowers organizations with full AI visibility and consolidated security that inspires confidence, drives innovation, and eliminates risk.
At TrendAI™, we’re always seeking exceptional talent; people who want to collaborate with the best and push boundaries together. Here, your work goes beyond building a career. You will help protect what matters and play a vital role in shaping a safer, more trustworthy AI-powered future.
AI Fearlessly.
Job Description:
LOCATION
On-Site / Hybrid (Austin, TX)
Position Summary
TrendAI is seeking a Senior DevOps / Release Engineer to own the CI/CD, build, release, and infrastructure backbone for our on-premises network security appliance, shipped as both physical hardware and virtual editions. The appliance is a large Java monolith built through Ant and gated primarily by GitHub Actions, with a shrinking legacy Jenkins footprint you will help retire as its current build-toolchain versions reach end-of-life/end-of-support. A blocking-mode agentic PR reviewer and an AI-based PR responder already run in production against it: a live system to mature, not a greenfield one to invent. You will build automated gates protecting release branches, sign and stage releases, and keep self-hosted runners and lab infrastructure healthy, balancing the rigor of physical/virtual lab release cycles with the modernization of cloud microservices and agentic automation. Secondary to that primary workload, you will extend the same CI/CD and infrastructure discipline to a companion set of Go and Node microservices deployed to AWS via Terraform/Terragrunt and the Serverless Framework. This is a senior IC role with broad autonomy over tooling and infrastructure decisions, and a mandate to push AI-assisted automation into daily operations rather than treat it as a side experiment.
Responsibilities
1. Own and operate the scheduled CI/CD pipeline suite (regression/BVT, integration, UI/functional, and nightly or on-demand workflows) for the on-prem appliance across main and release branches, triaging failures daily and distinguishing real regressions from lab or environmental noise.
2. Author, refactor, and maintain GitHub Actions workflows and reusable actions for the appliance product, including migrating the remaining legacy Jenkins jobs onto GitHub Actions ahead of their build-toolchain's end-of-life/end-of-support window, workflow-dispatch orchestration across multiple repositories, matrix builds, self-hosted runner targeting, and secrets/permissions hygiene.
3. Eliminate manual "build cop" duties by architecting and operating preventative branch gates: GitHub Merge Queue (or equivalent), speculative/batch merging, and automated flaky-test quarantine that removes unreliable tests from the gate without removing signal, so main and release branches never break.
4. Administer GitHub organization structure: repositories, branch protections, teams, user access, and the lifecycle of branches including cleanup of associated builds and artifacts when branches are deleted.
5. Modernize and maintain build/lab infrastructure supporting the appliance (bare metal and virtual), driving the transition toward ephemeral runners, automated patching, and declarative infrastructure-as-code, on both direct-managed hosts and machines shared with other teams.
6. Manage code signing and release packaging for the appliance: sign builds destined for continuous regression use, track and apply detection or definition-file updates through their PR lifecycle, and keep versioned build metadata consistent across the systems that consume it (test schedulers, release trackers).
7. Eliminate manual release bookkeeping by designing automated release-note and changelog generation from conventional commits and PR metadata (e.g., semantic-release), so release readiness reporting requires no hand-curated changelog page; coordinate fresh-install of validation/scan targets (physical and virtual) against the latest signed build.
8. Run, maintain, and administer third-party security and quality scanning pipelines (SAST/SCA and vulnerability scanners such as Coverity and Black Duck) across products, including version upgrades and license/user administration for the platforms themselves, and automate the triage of actionable findings into tracked engineering work.
9. Harden build environments by extending the OIDC-based, short-lived credential pattern already used in the microservices' CI (no static IAM keys) to appliance build and lab systems, replacing long-lived static secrets and passwords with short-lived, least-privilege identity mechanisms.
10. Extend the AI-assisted automation already running in production (a blocking-mode agentic PR reviewer gating findings before merge, an AI-based PR responder) into new categories of repetitive operational work: triage, log/report summarization, release notes drafting, remediation scripting, and agentic tooling for routine playbooks (e.g., environment refresh, credential rotation, scan-to-ticket workflows), with clear human review gates before anything touches a protected branch or production system.
11. Interface with adjacent engineering and platform teams to proactively track upstream infrastructure changes (e.g., registry, IdP migrations) and plan build/release adaptations ahead of time.
12. Partner with development, QA, and release management to scope new pipeline needs, converge on workflow conventions, and document runbooks so on-call and other engineers can operate the systems you own.
13. Secondary to the primary appliance workload, extend CI/CD and infrastructure support to a companion set of Go and Node microservices: container build/publish pipelines, Terraform/Terragrunt-driven environment provisioning, Serverless Framework deployment automation, and cloud infrastructure upkeep, applying the same rigor used for the appliance build infra.
Qualifications
1. 5+ years of professional experience in DevOps, release engineering, build engineering, or Linux systems administration supporting a production software product, ideally an on-premises hardware or virtual appliance.
2. Strong Bash and Python scripting skills for automation, tooling, and operational glue code.
3. Hands-on experience authoring and maintaining GitHub Actions workflows, including workflow-dispatch/cross-repo orchestration, self-hosted runners, matrix strategies, and secrets management; experience migrating a legacy CI platform (Jenkins or comparable) onto GitHub Actions is a strong plus.
4. Working knowledge of JVM or other compiled-language build lifecycles (Ant, Gradle, or comparable) and experience troubleshooting or decommissioning a legacy CI scheduler (e.g., Jenkins) in favor of GitHub Actions.
5. Solid Linux systems administration fundamentals: package/service management, disk and capacity planning, cron/scheduled jobs, user and credential management, and troubleshooting production build/lab hosts.
6. GitHub administration experience: repository, branch protection, team, and access management at organization scale.
7. Experience triaging CI/CD pipeline failures under time pressure, including distinguishing product regressions from environmental/infrastructure flakiness, and communicating status clearly to a broader engineering organization.
8. Familiarity with automated release tooling (semantic-release, conventional commits, or equivalent) and software release mechanics: build signing, versioning schemes, and coordinating a release candidate through validation gates.
9. Demonstrated use of AI-assisted or agentic tooling (such as Claude Code, GitHub Copilot, or comparable) in real operational or automation work, with the judgment to scope what runs autonomously versus what requires human review before it touches shared infrastructure.
10. Experience with security/quality scanning tooling (SAST, SCA, or comparable) including triage of findings