Senior DevOps / Release Engineer

TrendAI™, the global AI security leader and enterprise business unit of Trend Micro, empowers organizations with full AI visibility and consolidated security that inspires confidence, drives innovation, and eliminates risk.
 
At TrendAI™, we’re always seeking exceptional talent; people who want to collaborate with the best and push boundaries together. Here, your work goes beyond building a career. You will help protect what matters and play a vital role in shaping a safer, more trustworthy AI-powered future.
 
AI Fearlessly.

Job Description:

LOCATION

On-Site / Hybrid (Austin, TX)

Position Summary

TrendAI is seeking a Senior DevOps / Release Engineer to own the CI/CD, build, release, and infrastructure backbone for our on-premises network security appliance, shipped as both physical hardware and virtual editions. The appliance is a large Java monolith built through Ant and gated primarily by GitHub Actions, with a shrinking legacy Jenkins footprint you will help retire as its current build-toolchain versions reach end-of-life/end-of-support. A blocking-mode agentic PR reviewer and an AI-based PR responder already run in production against it: a live system to mature, not a greenfield one to invent. You will build automated gates protecting release branches, sign and stage releases, and keep self-hosted runners and lab infrastructure healthy, balancing the rigor of physical/virtual lab release cycles with the modernization of cloud microservices and agentic automation. Secondary to that primary workload, you will extend the same CI/CD and infrastructure discipline to a companion set of Go and Node microservices deployed to AWS via Terraform/Terragrunt and the Serverless Framework. This is a senior IC role with broad autonomy over tooling and infrastructure decisions, and a mandate to push AI-assisted automation into daily operations rather than treat it as a side experiment.

Responsibilities

1. Own and operate the scheduled CI/CD pipeline suite (regression/BVT, integration, UI/functional, and nightly or on-demand workflows) for the on-prem appliance across main and release branches, triaging failures daily and distinguishing real regressions from lab or environmental noise.

2. Author, refactor, and maintain GitHub Actions workflows and reusable actions for the appliance product, including migrating the remaining legacy Jenkins jobs onto GitHub Actions ahead of their build-toolchain's end-of-life/end-of-support window, workflow-dispatch orchestration across multiple repositories, matrix builds, self-hosted runner targeting, and secrets/permissions hygiene.

3. Eliminate manual "build cop" duties by architecting and operating preventative branch gates: GitHub Merge Queue (or equivalent), speculative/batch merging, and automated flaky-test quarantine that removes unreliable tests from the gate without removing signal, so main and release branches never break.

4. Administer GitHub organization structure: repositories, branch protections, teams, user access, and the lifecycle of branches including cleanup of associated builds and artifacts when branches are deleted.

5. Modernize and maintain build/lab infrastructure supporting the appliance (bare metal and virtual), driving the transition toward ephemeral runners, automated patching, and declarative infrastructure-as-code, on both direct-managed hosts and machines shared with other teams.

6. Manage code signing and release packaging for the appliance: sign builds destined for continuous regression use, track and apply detection or definition-file updates through their PR lifecycle, and keep versioned build metadata consistent across the systems that consume it (test schedulers, release trackers).

7. Eliminate manual release bookkeeping by designing automated release-note and changelog generation from conventional commits and PR metadata (e.g., semantic-release), so release readiness reporting requires no hand-curated changelog page; coordinate fresh-install of validation/scan targets (physical and virtual) against the latest signed build.

8. Run, maintain, and administer third-party security and quality scanning pipelines (SAST/SCA and vulnerability scanners such as Coverity and Black Duck) across products, including version upgrades and license/user administration for the platforms themselves, and automate the triage of actionable findings into tracked engineering work.

9. Harden build environments by extending the OIDC-based, short-lived credential pattern already used in the microservices' CI (no static IAM keys) to appliance build and lab systems, replacing long-lived static secrets and passwords with short-lived, least-privilege identity mechanisms.

10. Extend the AI-assisted automation already running in production (a blocking-mode agentic PR reviewer gating findings before merge, an AI-based PR responder) into new categories of repetitive operational work: triage, log/report summarization, release notes drafting, remediation scripting, and agentic tooling for routine playbooks (e.g., environment refresh, credential rotation, scan-to-ticket workflows), with clear human review gates before anything touches a protected branch or production system.

11. Interface with adjacent engineering and platform teams to proactively track upstream infrastructure changes (e.g., registry, IdP migrations) and plan build/release adaptations ahead of time.

12. Partner with development, QA, and release management to scope new pipeline needs, converge on workflow conventions, and document runbooks so on-call and other engineers can operate the systems you own.

13. Secondary to the primary appliance workload, extend CI/CD and infrastructure support to a companion set of Go and Node microservices: container build/publish pipelines, Terraform/Terragrunt-driven environment provisioning, Serverless Framework deployment automation, and cloud infrastructure upkeep, applying the same rigor used for the appliance build infra.

Qualifications

1. 5+ years of professional experience in DevOps, release engineering, build engineering, or Linux systems administration supporting a production software product, ideally an on-premises hardware or virtual appliance.

2. Strong Bash and Python scripting skills for automation, tooling, and operational glue code.

3. Hands-on experience authoring and maintaining GitHub Actions workflows, including workflow-dispatch/cross-repo orchestration, self-hosted runners, matrix strategies, and secrets management; experience migrating a legacy CI platform (Jenkins or comparable) onto GitHub Actions is a strong plus.

4. Working knowledge of JVM or other compiled-language build lifecycles (Ant, Gradle, or comparable) and experience troubleshooting or decommissioning a legacy CI scheduler (e.g., Jenkins) in favor of GitHub Actions.

5. Solid Linux systems administration fundamentals: package/service management, disk and capacity planning, cron/scheduled jobs, user and credential management, and troubleshooting production build/lab hosts.

6. GitHub administration experience: repository, branch protection, team, and access management at organization scale.

7. Experience triaging CI/CD pipeline failures under time pressure, including distinguishing product regressions from environmental/infrastructure flakiness, and communicating status clearly to a broader engineering organization.

8. Familiarity with automated release tooling (semantic-release, conventional commits, or equivalent) and software release mechanics: build signing, versioning schemes, and coordinating a release candidate through validation gates.

9. Demonstrated use of AI-assisted or agentic tooling (such as Claude Code, GitHub Copilot, or comparable) in real operational or automation work, with the judgment to scope what runs autonomously versus what requires human review before it touches shared infrastructure.

10. Experience with security/quality scanning tooling (SAST, SCA, or comparable) including triage of findings into actionable work, even if not with the specific tools used here.

11. Strong written communication: clear incident/status updates, runbook documentation, and cross-team coordination during release events.

12. Working knowledge of Docker and container packaging for microservices.

13. BS in Computer Science, Computer Engineering, or a related field, or equivalent practical experience.

Preferred Qualifications

Strongest candidates bring meaningful time spent on any of the following:

1. Prior ownership of a build farm or lab environment for an on-premises hardware/software appliance product, including physical and virtual device provisioning.

2. Familiarity with network security appliance or embedded systems release processes, where hotfix is not a first-class option and release validation carries extra weight.

3. Experience with vulnerability/patch management workflows, including converting scanner output (network vulnerability scanners, SAST/SCA) into tracked remediation work.

4. Experience administering static analysis platforms (Coverity, Black Duck, or comparable) at the license/version/user-management level, not just as a consumer of their findings.

5. Experience designing agentic or LLM-assisted operational workflows end to end: identifying candidate tasks, building the automation, and defining the guardrails that keep it safe in a regulated or compliance-sensitive environment.

6. Experience designing merge-queue or speculative-merge systems (GitHub Merge Queue, Bors, Mergify, or comparable) and automated flaky-test detection/quarantine that keep a shared branch continuously green without manual intervention.

7. Cloud infrastructure experience (AWS, Azure, or GCP) including infrastructure-as-code (Terraform/Terragrunt, CloudFormation, or comparable), useful for the microservices support scope.

8. Container orchestration experience (Kubernetes or comparable) for deploying and operating microservices in staging or production.

9. Experience owning or migrating artifact/container registries (e.g., Harbor, JFrog Artifactory, or comparable) at organization scale.

10. Experience with the Serverless Framework or comparable (AWS Lambda, API Gateway) for microservice deployment automation.

11. Experience leading or contributing to a CI/CD platform migration (e.g., Jenkins to GitHub Actions or another modern platform), including sequencing cutover so release branches stay protected throughout.

About the team

This team owns the CI/CD, build, and release infrastructure that powers our network security appliance family alongside our companion cloud microservices platform. We sit at the intersection of engineering, QA, and release management, keeping automated pipelines, build systems, and delivery gates running so the organization can ship with confidence. We take pride in eliminating manual toil, modernizing legacy build infrastructure with care, and championing AI-augmented automation while holding an uncompromising bar for operational stability, security, and release integrity.

What We Offer You:

You're important to us. What matters to you, matters to us too. Trend Micro provides benefit options for you and your family. Here some of the top-rated benefits that employees enjoy today:

Comprehensive health benefits and paid time off package

Pre-partum, maternity, parental, medical leave and adoption assistance 

Mental Health Wellness Program & Annual Wellness Incentive

401(k) with company match

Pet Insurance

Collaborative and innovative culture

We are committed to fostering a professional, respectful, and inclusive work environment that promotes collaboration and high performance. We value diverse backgrounds and perspectives and welcome candidates who bring unique strengths and experiences. If you’re excited about this role and believe you can contribute and grow with us, we encourage you to apply. 

Be Passionate. Be Innovative. Be a Trender.

This position does not offer sponsorship for work permit applications or renewals, either now or in the future. Candidates must be authorized to work in the U.S. without the need for employment-based visa sponsorship, both currently and moving forward. The company will not sponsor applicants for U.S. work visa status for this role (including, but not limited to, H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT, or any other employment-based visa

#LI-BM1