Lead, DevSecOps Engineer

As a Dev. Sec. Ops Engineer, you will bridge the gap between development, operations, and information security. Reporting to the Application Security Lead, you will architect, maintain, and scale security automation across our software development lifecycles (SDLC). Your primary mandate is to shift security left by embedding SAST, DAST, and SCA tools directly into modern CI/CD pipelines, eliminating security bottlenecks and ensuring continuous code compliance.

Key Responsibilities

Integrate and manage static, dynamic, and software composition analysis tools into continuous integration and continuous deployment (CI/CD) pipelines. Tooling Optimization: Own, configure, and fine-tune App. Sec platforms including Checkmarx, Semgrep, Snyk, and Sonar. Qube to minimize false positives and maximize actionable alerts.

Automated & Manual DAST: Configure automated dynamic scanners and leverage Burp Suite Professional for targeted security testing on APIs and web services. Vulnerability Remediation & Triage: Act as the primary technical point of contact to triage code vulnerabilities, providing clear remediation guidance and proof-of-concept fixes directly to engineering teams.

Open Source Security (SCA): Utilize Snyk and similar tools to monitor open-source dependencies, license compliance, and third-party software supply chain vulnerabilities. Policy Enforcement: Define automated gatekeeping thresholds (e.g., failing builds for critical/high vulnerabilities) within the deployment pipeline based on internal security policies.

Requirements

4+ years of experience in DevOps, software engineering, or application security, with at least 2+ years dedicated exclusively to Dev. Sec. Ops practices. Tooling Command: Proven, deep technical proficiency with the following tools: SAST: Checkmarx, Semgrep, Sonar. Qube SCA & Container Security: Snyk DAST / Pen-testing: Burp Suite Professional CI/CD Ecosystems: Extensive experience building automation plugins and pipelines in GitHub Actions, GitLab CI, Jenkins, or Bitbucket Pipelines.

Infrastructure as Code (IaC): Solid understanding of cloud-native infrastructure, containerization (Docker, Kubernetes), and secure IaC deployment (Terraform). Development Background: Ability to read and understand code snippets across multiple languages (e.g., Python, Java, Go, Node.js ). Certifications: Certifications such as Certified Dev.

Sec. Ops Professional (CDP), Practical Dev. Sec. Ops (CDEP), or CSSLP are highly preferred Benefits Performance Bonus

• Get rewarded for the impact you make Private Insurance
• Comprehensive health coverage for you Paid Time Off
• Take the time you need to recharge and come back stronger Learning & Development
• Company-sponsored training, courses, and professional certifications Hybrid Work Arrangement
• Enjoy the flexibility of working both remotely and from the office Career Growth
• Work closely with experienced leaders and take on meaningful ownership as we scale Employee Perks
• Enjoy exclusive discounts, partnerships, and lifestyle perks Collaborative & High-Ownership Culture
• Work with smart, driven people in cross-functional teams, take ownership, and make a meaningful impact for our users.