🕒 16 days ago
As a DevSecOps Engineer, you'll lead the design and implementation of secure, automated CI/CD pipelines while embedding security into the software development lifecycle.
DevSecOps Engineer
🕒 17 days ago
Cloud Security EngineeringSecurity AutomationCI/CD IntegrationDevsecops Architecture
📜 Description
- Design and implement cloud security controls across AWS, applying defense-in-depth across identity, network, and infrastructure layers.
- Develop automation scripts and tools in Python and Bash to streamline security operations and enforce compliance.
- Integrate security into CI/CD pipelines and DevOps workflows, ensuring security is a key component of the delivery process.
- Design, implement, and maintain enterprise DevSecOps architectures that integrate security throughout all phases of the SDLC.
- Integrate automated security testing into software delivery pipelines, including SAST, DAST, and infrastructure security scanning.
- Operate the vulnerability management lifecycle end to end using tools such as Qualys.
🛠️ Requirements
- Minimum 3 years of relevant experience in DevSecOps, security engineering, or DevOps with a strong security focus.
- Solid understanding of AppSec principles, the OWASP Top 10, and secure coding practices.
- Good knowledge of Linux OS administration, TCP/IP networking concepts, virtualization, and databases.
- Proficiency with versioning tools (Git) and hands-on experience with CI/CD concepts and methodologies.
- Good understanding of scripting languages (Python, Bash).
- Knowledge of vulnerability scanning tools (Qualys, Nessus, etc.).
- Knowledge of SAST/DAST tools (SonarQube, OWASP ZAP, Burp Suite, etc.).
- Understanding of the vulnerability management lifecycle.
- Good knowledge of monitoring technologies/tools (Grafana, Prometheus, etc.).
- Familiarity with security tooling around Terraform, Kubernetes security, and vulnerability scanners.
Full job description
Responsibilities
- Cloud Security Engineering: Design and implement cloud security controls across AWS (primary), applying defense-in-depth across identity, network, and infrastructure layers. Translate security requirements into concrete, automated guardrails.
- Security Automation: Develop automation scripts and tools in Python and Bash to streamline security operations, enforce compliance, and reduce manual effort across the environment.
- Secure CI/CD: Integrate security into CI/CD pipelines and DevOps workflows, ensuring security is a first-class component of the delivery process rather than an afterthought.
- DevSecOps Architecture: Design, implement, and maintain enterprise DevSecOps architectures that integrate security throughout all phases of the SDLC. Establish reference architectures, technical standards, engineering patterns, and best practices for DevSecOps implementations.
- Automated Security Testing: Integrate automated security testing into software delivery pipelines, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), container and image scanning, secret detection and credential management, and infrastructure security scanning.
- Vulnerability Management: Operate the vulnerability management lifecycle end to end - scanning, triage, prioritization, remediation tracking, and reporting - using tools such as Qualys.
- Governance and Compliance: Implement security measures and governance policies - not just deploying controls, but writing policies, ensuring they are in place, and running periodic compliance reviews aligned with regulatory requirements (e.g., NIS2, GDPR).
- Container and Kubernetes Security: Apply security best practices to containerized workloads and Kubernetes (EKS), including image scanning, runtime considerations, and hardening.
- Documentation and Standards: Produce architecture artifacts and security documentation to support audit readiness and continuous compliance initiatives.
- Collaboration: Work with cross-functional teams - infrastructure, development, and cybersecurity - to ensure security controls are practical, adopted, and maintained.
Qualifications
- Minimum 3 years of relevant experience in DevSecOps, security engineering, or DevOps with a strong security focus.
- Solid understanding of AppSec principles, the OWASP Top 10, and secure coding practices.
- Good knowledge of Linux OS administration, TCP/IP networking concepts, virtualization, and databases.
- Proficiency with versioning tools (Git) and hands-on experience with CI/CD concepts and methodologies.
- Good understanding of scripting languages (Python, Bash).
- Knowledge of vulnerability scanning tools (Qualys, Nessus, etc.).
- Knowledge of SAST/DAST tools (SonarQube, OWASP ZAP, Burp Suite, etc.).
- Understanding of the vulnerability management lifecycle.
- Good knowledge of monitoring technologies/tools (Grafana, Prometheus, etc.).
- Familiarity with security tooling around Terraform, Kubernetes security, and vulnerability scanners.
- Strong documentation and technical writing skills (mandatory).
- Understanding of product lifecycle and software release processes.
- Attention to detail and the ability to quickly adapt to new technologies.
Nice to Have
- Experience with Infrastructure as Code (Terraform, Ansible), YAML, and orchestration.
- Experience working in Agile/Scrum methodologies.
- Experience supporting continuous Authority to Operate (ATO) initiatives.
- Exposure to multi-account AWS governance (SCPs, IAM boundaries) and secret management (HashiCorp Vault, AWS Secrets Manager).
Similar jobs
Search more DevSecOps Engineer jobs
🕒 24 days ago
Du verbesserst die Sicherheit von Cloud-, Kubernetes-, Netzwerk-, IAM- und CI/CD-Umgebungen, koordinierst Schwachstellenbehebungen und unterstützt Monitoring, Incident Response und ISO-27001-Compliance.
📅 Aug 3
As an SRE at Docket, you will deploy and operate AWS infrastructure, automate software integration processes, and promote DevOps culture within the team.
Coordenação de Segurança da Informação - Foco DevSecOps
📅 Jul 6
Central Ailos👥 1001 - 5000 employees🏢 Financial Services
📅 Jul 6
Coordenar a equipe de DevSecOps e AppSec, definindo diretrizes de segurança e promovendo uma cultura de segurança no desenvolvimento de aplicações e integrações.
📅 Jun 10
As a DevSecOps Engineer (Salesforce), you'll design and implement secure CI/CD pipelines and modern DevSecOps practices to enhance application delivery for AI-driven development teams.
📍 Local to D.C. metro area - Hybrid💰 $125k - $145k / year💼 Full-Time🎹 Mid-level🗺️ DevSecOps Engineer