DevSecOps Engineer

Location: New Orleans, LA or remote (US) Reports to: Chief Information Security Officer Type: Full-time About the role You'd be joining at the start of a program to consolidate our security tooling and mature how we build software. That means you get to make foundational decisions rather than inherit someone else's. It also means the first year is genuinely a build, not a maintenance job.

You'll own the engineering half of the program: identity infrastructure, the API and CI/CD security layer, and infrastructure-as-code. A Security Engineer joins alongside you to own detection, vulnerability management and compliance evidence. What you'll own in the first year API security and lifecycle. API gateway as a mandatory front door so no service can exist outside our inventory, and build an API register with owners and lifecycle state enforced in CI.

Identity infrastructure. Consolidate a split Active Directory and Entra ID estate into a single directory. Build automated joiner-mover-leaver provisioning between our HR system and our identity provider using API-driven inbound provisioning. Zero trust network access. Replace our VPN with per-application access. Application discovery, connector deployment, policy authoring, phased cutover, and a properly documented decommission.

Pipeline security. Integrate SAST, DAST, dependency and secret scanning into CI as gates rather than reports. Own the developer experience of this and work with them to build processes that will be followed. Infrastructure as code. Bring our Azure estate under Terraform or Bicep with policy-as-code guardrails, so configuration drift becomes visible instead of discovered.

Endpoint and device posture. Device compliance signals feeding Conditional Access, which is a prerequisite for the zero trust work above.

What we're looking for

4+ years in a DevOps, platform, cloud or security engineering role, with meaningful ownership of production infrastructure Strong Azure experience: RBAC, networking, Key Vault, managed identities, Defender for Cloud Real CI/CD depth: you've built pipelines, not just used them. GitHub Actions preferred Infrastructure as code in production (Terraform, Bicep, Pulumi) Comfortable writing code, not just configuration.

Python, Go, Power. Shell or similar Practical identity knowledge: OIDC, SAML, SCIM, Conditional Access, service principals API security fundamentals: authentication and authorization patterns, gateway architecture, the OWASP API Top 10 You've worked somewhere with an audit and understand why evidence matters, even when it's tedious Experience working with overseas teams Nice to have Experience migrating between identity providers or collapsing a dual-directory estate ZTNA deployment experience with any vendor Container and Kubernetes security SOC 2 or ISO 27001 exposure from the engineering side Experience in a small team where you owned something end to end What this job is not It isn't a ticket queue, and it isn't a compliance checkbox role.

You will be building and migrating systems on day one. If you want deep specialization in one narrow domain, this isn't it. If you want breadth, ownership and the ability to point at things you built, it is. We'd rather you tell us something is a bad idea than build it quietly. That includes telling the CISO.

What we offer

Direct influence on architecture decisions before they're locked in Budget for training and certification A small team where your work is visible We're an equal opportunity employer. If you meet most of this and not all of it, apply anyway — we'd rather read your application than guess.