Purpose of the Role

The Deputy General Manager – SDV DevSecOps Lead owns the CI/CD/CT strategy, pipeline architecture, and security posture across all software layers of the Software Defined Vehicle: onboard embedded firmware and AAOS, through to cloud backend services. The role defines and governs enterprise-grade DevSecOps frameworks — integrating SAST, SCA, DAST, binary security assessment, and SBOM-first delivery — and translates ASPICE, ISO/SAE 21434, and UNECE R155/R156 obligations into automated pipeline controls. The DGM leads a multi-disciplinary DevOps and security engineering team, acts as the primary interface to OEM programme heads and Tier-1 partners, and is accountable for delivery quality and regulatory compliance across all SDV programmes.

Job Responsibility

Platform Strategy & CI/CD/CT Architecture

•Define the DevSecOps technology roadmap covering all SDV software layers — ECU/MCU firmware, AAOS, and cloud microservices — and own the enterprise CI/CD/CT reference pipeline framework.

•Architect mandatory security gate policy: SAST, SCA, DAST, and binary hardening checks with defined failure thresholds, waiver governance, and SBOM generation as a first-class release artefact.

•Drive pipeline-as-code and GitOps adoption; govern artefact management, branching strategy, release train cadence, and toolchain selection across programme teams.

•Oversee HIL/SIL integration within the CI pipeline and the full OTA release chain: binary signing, delta generation, manifest creation, and SUMS compliance verification.

DevSecOps Governance & Security Integration

•Embed security controls at every pipeline stage for the full onboard-to-offboard SDV stack; enforce zero-exception security gate policy across all release streams.

•Govern SAST/SCA/DAST toolchain selection and CVE lifecycle management — SBOM-correlated ingestion, severity SLA enforcement, and closure tracking within the programme CSMS register.

•Direct binary security assessments of ECU firmware, OTA packages, and IVI APKs; collaborate with Cybersecurity Architecture to close the loop between TARA outputs and automated pipeline controls.

•Operationalise UNECE R155/R156, ISO/SAE 21434, and ASPICE obligations as pipeline policy; own audit evidence packages for homologation and regulatory assessments.

OEM & Supplier Ecosystem Management

•Serve as the DevSecOps interface to OEM programme management; present pipeline maturity,



security posture, and release readiness at programme steering reviews.

•Define and enforce DevSecOps acceptance criteria for Tier-1/Tier-2 software deliverables; conduct supplier pipeline integration reviews and audit binary security baselines.

•Negotiate toolchain and process requirements with OEM customers on customer-funded development programmes; govern cross-organisation traceability linkages in the ALM toolchain.

Organisation Leadership

•Build and lead a cross-functional team of DevOps, release, and security automation engineers; define the capability roadmap and drive targeted hiring and upskilling.

•Establish a DevSecOps centre of excellence — reference architectures, pipeline templates, and internal training — consumed by all SDV programme teams.

•Foster a culture of engineering rigour: measurable pipeline quality gates, blameless post-mortems, and systematic knowledge-sharing across programme boundaries.

Desired Candidate Profile

Education & Experience

•B.E. / B.Tech in Computer Science, Electronics, or Information Technology; M.E. / M.Tech preferred. Advanced DevOps or security certifications (CKA, CISSP, GitLab Professional) desirable.

•Minimum 12 years of software engineering experience with at least 4 years leading a DevOps, platform engineering, or DevSecOps function in an automotive OEM or Tier-1 setting.

•Demonstrated ownership of CI/CD/CT strategy spanning embedded (Yocto / AAOS) and cloud workstreams, with direct OEM customer or programme delivery exposure.

Technical Expertise

•Strong expertise in enterprise CI/CD toolchains: Jenkins, GitLab CI/CD, GitHub Actions, ArgoCD; containerised build environments (Docker, Kubernetes); Yocto SDK pipeline integration.

•Hands-on experience with DevSecOps tooling: SAST (Coverity, Semgrep), SCA (Black Duck), DAST (OWASP ZAP); binary analysis (checksec, Binwalk, LIEF); SBOM generation (CycloneDX / SPDX).

•Deep understanding of automotive cybersecurity standards (ISO/SAE 21434, UNECE R155/R156, ASPICE); familiarity with secure OTA, PKI,



and onboard-to-cloud security architecture.

•Proficiency in Python and Bash for pipeline automation and internal tooling; experience with ALM platforms (Jira, Confluence, Bitbucket) and observability stacks (Grafana, Prometheus).

Tata Motors is an Equal Opportunity Employer, committed to a fair and transparent hiring process. All recruitment decisions are based strictly on Merit, Role alignment, and Business requirements. It does not solicit or accept any form of payment or gratuity from candidates at any stage of the recruitment process. Any such request received should be considered fraudulent and reported immediately.

About Tata Motors:

Part of the USD 180 billion Tata group, Tata Motors Limited (BSE: 500570; NSE: TATAMOTORS), a USD 52 billion organization, is a leading global automobile manufacturer of cars, utility vehicles, pick-ups, trucks, and buses, offering an extensive range of integrated, smart, and e-mobility solutions. With ‘Connecting Aspirations’ at the core of its brand promise, Tata Motors is India’s market leader in commercial vehicles and ranks among the top three in the passenger vehicles market.

Tata Motors strives to bring new products that captivate the imagination of GenNext customers, fuelled by state-of-the-art design and R&D; centres located in India, the UK, the US, Italy, and South Korea. By focusing on engineering and tech- enabled automotive solutions catering to the future of mobility, the company’s innovation efforts are focused on developing pioneering technologies that are both sustainable and suited to the evolving market and customer aspirations. The company is pioneering India's Electric Vehicle (EV) transition and driving the shift towards sustainable mobility solutions by developing a tailored product strategy, leveraging the synergy between Group companies and playing an active role in liaising with the Government of India in developing the policy framework.

With operations in India, UK, South Korea, Thailand and Indonesia, Tata Motors markets its vehicles in Africa, the Middle East, Latin America, Southeast Asia, and the SAARC countries. As of March 31, 2025, Tata Motors’ operations include 93 consolidated subsidiaries, two joint operations, four joint ventures, and numerous equity-accounted associates, including their subsidiaries, over which the company exercises significant influence.

📌 Deputy General Manager – Software Defined Vehicle (SDV)l DevSecOps Lead (Pune)
🏢 TataMotors
📍 Pune