DevSecOps Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Evaluate application designs and architectures to uncover potential security vulnerabilities and suggest secure design patterns.

• Conduct both manual and automated code reviews to detect vulnerabilities and assist in remediation efforts.

• Integrate and uphold application security tools within CI/CD pipelines for ongoing testing.

• Execute application security testing, including SAST, DAST, SCA, and oversee penetration testing.

• Manage vulnerability findings through triage, prioritization, tracking, and coordinating remediation with development teams.

• Collaborate with developers to adopt secure coding practices and offer practical guidance and training.

• Assist in application-level incident response, including the investigation and resolution of security incidents.

• Monitor and report on vulnerability status and risk posture during formal reviews and program updates.

• Enforce established security policies and recommend enhancements.

• Coordinate DevSecOps initiatives with development roadmaps, releases, and operational priorities.

• Lead daily scrum sessions and Sprint planning for DevSecOps.

• Aid Project Managers in addressing unforeseen tasks and priorities in the team backlog while eliminating obstacles.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, or a related discipline with 5+ years of experience (or equivalent experience).

• Additional experience may be accepted in place of a degree.

• Over 5 years of hands-on application security experience in a software development setting.

• Experience in integrating security within CI/CD pipelines and DevSecOps workflows.

• Demonstrated ability to manage and track vulnerabilities through to remediation in partnership with development teams.

• Knowledge of secure software development lifecycle (SDLC) principles.

• Experience in supporting or engaging in security incident response.

• Strong communication skills to convey security risks and recommendations to technical teams.

• Proven experience working in cross-functional environments alongside developers, architects, and operations teams.

• Experience within a DevSecOps team using an Agile development framework.

• U.S. Citizenship is required.

• Experience in conducting secure code reviews and identifying common vulnerabilities (e.g., OWASP Top 10).

• Familiarity with application security testing tools (SAST, DAST, SCA) and the ability to interpret results.

• Experience in supporting federal or regulated environments (e.g., DOJ, FedRAMP, FISMA).

• Understanding of threat modeling methodologies and secure architecture practices.

• Experience with container and cloud security (e.g., Kubernetes, AWS, Azure).

• Knowledge of risk-based vulnerability prioritization and release gating practices.

🏝️ Benefits

• Comprehensive health, dental, and vision insurance.

• Competitive salary and performance-based bonuses.

• Opportunities for professional development and continuous learning.

• Flexible working hours and options for remote work.

• Generous paid time off and holiday leave.

• Retirement savings plan with company matching contributions.