Senior Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Act as the technical steward for pipeline security tools, which encompass SAST, SCA, secrets detection, container scanning, and artifact signing.

• Evaluate the effectiveness and coverage of tooling; identify deficiencies and spearhead enhancements, consolidations, or replacements.

• Create automated and manual penetration-testing capabilities with swift feedback loops into engineering.

• Assist in the development of mature security operations and incident response capabilities.

• Establish the long-term strategy for security tools and processes in collaboration with Cybersecurity and Engineering leadership.

• Convert NIST SP 800-53, NIST SP 800-171, and RMF requirements into actionable pipeline gates, thresholds, and policies.

• Maintain risk-based pass/fail criteria while reducing false positives.

• Ensure that tooling outputs generate assessor-ready evidence for authorizations, ongoing monitoring, and audits.

• Oversee documented and traceable exception and manual-review processes.

• Enforce artifact signing, signature verification, commit signing, branch protection, and repository rulesets.

• Automate the creation and upkeep of SBOMs and VEX data.

• Shift security checks earlier into developer workstations, pre-commit hooks, and pull requests.

• Collaborate with engineering teams to integrate security into workflows.

• Utilize AI tools for vulnerability triage, remediation, and security automation; assess emerging AI capabilities.

⛳️ Requirements

• A minimum of 7 years in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years managing security tooling within CI/CD pipelines.

• Extensive hands-on experience in configuring, tuning, and enforcing SAST, SCA, secrets detection, and container scanning tools in production pipelines, including risk-based gates, vulnerability thresholds, and exception processes.

• Proven experience aligning security tooling and pipeline controls with NIST SP 800-53, NIST SP 800-171, or RMF requirements, and generating evidence for assessments or authorizations.

• A solid history of evaluating, selecting, or enhancing security tools, with the ability to influence engineering teams without direct authority.

• Experience in scripting or automation using Python, Bash, or similar languages.

• Security+ or an equivalent DoD 8140 qualifying certification, or the capability to obtain it within 2 months of hire.

• U.S. citizenship and residency in the U.S.

• Preferred: Familiarity with GitHub, Argo CD, JFrog, and Snyk.

• Preferred: Experience in DoD software factory or Government DevSecOps environments.

• Preferred: Experience supporting ATO efforts, including control assessments and POA&M management.

• Preferred: Experience with software supply chain integrity and policy-as-code practices, such as artifact signing, signature verification, SBOMs, OPA, or Kyverno.

• Preferred: Experience applying AI and LLM tools to security engineering.

• Preferred: Experience with penetration testing tools, processes, and strategies.

• Preferred: Familiarity with cloud and container environments such as GitHub, Docker, Kubernetes, and AWS.

• Preferred: Advanced certifications like CISSP, SecurityX (CASP+), or GIAC.

• Preferred: Active security clearance (Top Secret highly desired).

🏝️ Benefits

• Bonuses

• Equity

• Comprehensive benefits package