Senior DevSecOps Engineer – Vulnerability Management

This is a fully remote position, open to applicants in Lithuania, +1 more country.

📋 Description

• Evaluate current CI/CD pipelines, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, as well as the security scanning tools that are currently in use.

• Develop a cohesive vulnerability triage process to gather findings, remove duplicates, and prioritize risks utilizing CVSS, EPSS, CISA KEV, and indicators of exploitability/reachability.

• Execute comprehensive vulnerability tracking with assigned owners and documented resolution statuses.

• Incorporate SAST, software composition analysis, secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines.

• Establish security gates to avert regression.

• Implement branch management and repository hygiene protocols.

• Provide weekly vulnerability management reports and progress metrics to the CISO and senior leadership.

• In Phase 1, spearhead improvements in vulnerability management and the integration of DevSecOps security.

• In Phase 2, direct cloud and infrastructure engineering efforts and vulnerability management operations within the DevOps team.

• Oversee cloud and infrastructure engineers and a vulnerability management analyst during Phase 2.

⛳️ Requirements

• Around 8+ years of experience in DevOps or platform engineering, with a strong background in DevSecOps.

• Demonstrated experience in implementing automated CI/CD security gates using GitHub Actions or Jenkins.

• Practical experience in managing vulnerabilities at scale, including aggregation of findings, deduplication, risk-based prioritization, and tracking of remediation efforts.

• Solid understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.

• Ability to translate complex security findings into clear, actionable reports for non-technical stakeholders and senior management.

• Capability to coordinate security remediation efforts across engineering teams.

• Experience with vulnerability aggregation and management platforms like DefectDojo.

• Expertise in container and Kubernetes security.

• Familiarity with software bill of materials (SBOM), software supply chain security, SLSA, and Sigstore.

• Experience with Azure DevOps or AWS CodePipeline.

• Proficiency in dashboard development and security reporting using Power BI or Datadog.

• English working proficiency and some overlap with US Eastern time.

🏝️ Benefits

• Contract duration: 12 months.

• Opportunity to engage with modern AI coding tools.

• Learn security practices from experienced tower leads.

• Potential for leadership advancement within the client's DevOps team during Phase 2.