DevSecOps Engineer

The Position 

We are seeking a hands-on DevSecOps Engineer to embed automated security into software delivery. The role focuses on CI/CD security, security scanning, risk-based gates, Secure SDLC baselines, and vulnerability remediation across product and internal engineering teams. 

You will partner with AppSec, Product Engineering, Platform/SRE, and Security Operations to deliver reusable controls, developer-friendly feedback, and measurable security outcomes. 

Core Responsibilities 

• Integrate secret scanning, SAST, SCA/SBOM, container, IaC, and appropriate DAST checks into pull request, build, and release workflows. 
• Implement risk-based CI/CD security gates, false-positive handling, and documented exceptions. 
• Build scripts and API integrations for scan aggregation, ticketing, evidence collection, and security reporting. 
• Maintain visibility into scan coverage, gate decisions, vulnerability trends, and control adoption. 
• Enable Product Security, Security Champions, and SRE teams; use AI tools responsibly to accelerate analysis, scripting, and documentation while verifying outputs. 

Required Qualifications 

• Bachelor's degree in Computer Science, Engineering, Cybersecurity, or equivalent practical experience. 
• 3+ years in DevSecOps, DevOps/platform engineering, AppSec, or software engineering with security automation. 
• Hands-on experience with Git and CI/CD platforms (e.g., GitHub Actions, GitLab CI, Jenkins, Azure DevOps). 
• Ability to automate workflows using Python, Bash, or similar languages and work with APIs. 
• Experience with security scanning (e.g., SAST, SCA, secrets, containers, IaC, DAST), finding triage, and remediation. 
• Working knowledge of Secure SDLC, Linux, containers, cloud fundamentals, and OWASP Top 10. 
• Strong developer collaboration skills and ability to use AI assistants effectively, with appropriate review of generated outputs. 

Preferred Qualifications 

• Experience with Kubernetes, Terraform, AWS/Azure, and container build/release workflows. 
• Exposure to tools such as CodeQL, Semgrep, SonarQube, Snyk, Trivy, Gitleaks, Checkov, or ZAP. 
• Knowledge of SBOM, software supply-chain security, signing/attestation, or OWASP SAMM/NIST SSDF. 
• Experience with AI-assisted SDLC (AI-SDLC), such as AI coding assistants, AI-driven security reviews, or remediation automation, is a plus.