Senior DevSecOps Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Enhance, secure, and standardize software delivery practices across various development teams.

• Act as a technical leader and reliable advisor on application security and DevSecOps.

• Oversee or assist with application vulnerability management from detection to remediation, exception, or formal risk acceptance.

• Evaluate findings from security tools, penetration tests, dependency scans, cloud scans, code reviews, and internal assessments.

• Prioritize vulnerabilities based on severity, exploitability, business impact, application criticality, exposure, compensating controls, and compliance requirements.

• Collaborate with development teams to drive the remediation of high-risk and recurring vulnerabilities.

• Monitor and report on remediation progress, vulnerability trends, SLA performance, and the overall application security posture.

• Establish vulnerability remediation SLAs, exception processes, risk acceptance criteria, and standards for security reporting.

• Design, implement, manage, and secure cloud-based application environments, preferably within Azure.

• Utilize Azure security best practices, secure access patterns, encryption, logging, monitoring, and policy-based controls.

• Supervise and troubleshoot cloud services while ensuring secure configurations and hardening of hosting environments, databases, networking, storage, and platform services.

• Implement and enhance secrets management across development, test, staging, and production environments.

• Remove hardcoded secrets, improve secret rotation, and incorporate secrets scanning into repositories and CI/CD pipelines.

• Provide guidance to developers, architects, QA engineers, product teams, and engineering managers on security and DevOps practices.

• Develop secure coding guidance, reusable examples, internal documentation, reference patterns, and developer-friendly security standards.

• Conduct training sessions, workshops, and coaching on application, API, CI/CD, secrets, dependency, and cloud security.

• Mentor junior DevOps engineers and foster a collaborative security culture.

• Contribute to application security standards, secure coding policies, cloud security standards, pipeline requirements, and DevSecOps governance.

• Ensure alignment of applications, cloud environments, pipelines, and development workflows with security and compliance requirements.

• Assess the effectiveness of security tools, automation, standards, and processes.

⛳️ Requirements

• Over 8 years of experience in DevOps, DevSecOps, application security, security engineering, software engineering, platform engineering, or a related technical discipline.

• Extensive hands-on experience with cloud services, preferably Azure, encompassing application hosting, networking, storage, databases, identity, monitoring, access control, and security services.

• More than 5 years of experience in designing, developing, securing, and maintaining CI/CD pipelines using Azure DevOps, GitHub Actions, YAML, GitLab CI, Jenkins, or similar platforms.

• Strong background in embedding SAST, DAST, SCA, secrets scanning, dependency scanning, container scanning, and other automated security validation tools into CI/CD pipelines.

• In-depth understanding of secure SDLC, DevSecOps principles, secure software development practices, and modern application security concepts.

• Comprehensive knowledge of OWASP Top 10, API security, authentication, authorization, input validation, session management, encryption, secure error handling, secrets handling, and software supply chain risk.

• Experience in identifying, triaging, prioritizing, and driving remediation of application security vulnerabilities.

• Familiarity with vulnerability management practices, security scanning tools, risk assessment, remediation tracking, exception handling, and risk acceptance workflows.

• Proficiency with secrets management solutions like Azure Key Vault, HashiCorp Vault, or equivalent technologies.

• Experience in scripting and automation using PowerShell, Azure CLI, Bash, Python, Go, or similar technologies.

• Ability to read, comprehend, and analyze application code in C#, Java, JavaScript, TypeScript, Python, Go, or similar languages.

• Knowledge of frameworks such as OWASP, NIST, CIS, SOC 2, ISO 27001, PCI DSS, GDPR, or similar standards.

• Advanced certifications in cloud, DevOps, or security such as AZ-400, Microsoft Certified: Azure Security Engineer, CISSP, CSSLP, CCSP, GWEB, GWAPT, or equivalent are considered a plus.

• Strong skills in troubleshooting, analytical thinking, problem-solving, communication, independent work, prioritization, and cross-functional collaboration.

• A proactive approach to continuous improvement, automation, secure engineering practices, and enabling developers.

🏝️ Benefits

• Flexibility to work remotely.

• Medical, dental, and vision coverage with both company-paid and employee-paid options.

• Paid holidays, sick days, and personal time off.

• Employee Resource Groups (ERGs) that promote connection and inclusion.

• On-site amenities including a covered basketball court, soccer field, track, pickleball/tennis courts, gym, etc.

• Dog-friendly campus and WiFi-accessible courtyards.

• 401(k) plan with a 5% company match.

• Coverage for employee professional development and wellness.