Senior DevSecOps Engineer – Contract

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, develop, and manage sophisticated SAST and SCA automation within developer workflows and CI/CD pipelines.

• Construct and enhance vulnerability management and remediation processes, encompassing triage, prioritization, ownership, and tracking until resolution.

• Fortify software supply chain security across dependencies, build systems, artifact integrity, and provenance.

• Create CI/CD and GitHub-based automation that enforces security measures without hindering delivery.

• Develop infrastructure as code and reusable automation frameworks for adoption by other teams.

• Enhance container and dependency security, which includes image scanning, base image governance, and runtime hardening.

• Assess and implement AI-assisted security features that boost developer productivity and enhance SDLC security.

• Set standards and reference implementations, assisting engineering teams in their adoption.

• Convey findings, trade-offs, and suggestions to engineers, security leadership, and non-technical stakeholders.

• Record decisions, configurations, and operational context for maintainability post-engagement.

• Collaborate with the client's team, tools, and processes while receiving engagement support from Stevens.

• Engage in talent, technical, and client interviews as part of the selection process.

⛳️ Requirements

• At least eight years of pertinent experience in application security, DevSecOps, platform engineering, or a closely related field.

• Proven hands-on technical proficiency.

• Extensive experience with SAST and SCA tools, including SonarQube, Nexus IQ, or equivalent solutions.

• Practical experience with Nexus Repository or similar artifact repositories.

• Experience in dependency governance and policy enforcement.

• Hands-on experience with vulnerability management programs and remediation processes in large organizations.

• Familiarity with SBOMs, artifact signing, provenance, and dependency governance.

• Strong CI/CD experience using GitHub Actions, including reusable workflows and large-scale GitHub-based automation.

• Experience transitioning from Jenkins to GitHub Actions or comparable CI/CD migration experience.

• Proficient in Terraform and infrastructure as code.

• Experience in building reusable automation frameworks.

• Solid understanding of container security, image scanning, and dependency hygiene.

• Interest in and exposure to AI-assisted security and developer tools.

• Proficiency in scripting and automation with Python, Bash, PowerShell, or a similar language.

• Proven track record of successfully operating in complex enterprise environments with multiple teams, legacy systems, and competing priorities.

• Strong communication skills and judgment to balance security rigor with real-world delivery challenges.

• Must reside and perform work in the United States throughout the engagement.

• Must be legally authorized to work in the United States.

• Completion of criminal background checks and identity verification is required.

• Preference for corp-to-corp business entities; 1099 arrangements will be considered for suitable candidates.

🏝️ Benefits

• Commitment to full-time engagement.

• Engagement duration of 6 to 9 months.

• Payments processed bi-weekly through the contractor payroll platform.

• Preference for corp-to-corp contracting via the contractor’s own LLC or corporation.

• 1099 arrangements will be considered for the right candidate.

• Stevens will provide engagement support throughout the client engagement.