DevSecOps Engineer

Job summary

The DevSecOps Engineer embeds security across the software development lifecycle and CI/CD pipelines while hardening cloud environments, primarily on AWS with working proficiency in Azure and/or GCP. The role builds developer-adopted security guardrails, reusable infrastructure-as-code patterns, and pipeline controls; threat-models services; and uses Wiz to prioritize and remediate cloud and application findings. It also supports SOC 2, audit, and regulatory requirements through secure SDLC controls and evidence.

Qualifications

• Hands-on experience embedding security into CI/CD pipelines and the software development lifecycle.
• Application security experience, including threat modeling and secure coding guidance.
• Strong AWS security expertise and working proficiency in Azure and/or GCP security.
• Proficiency with Terraform and/or CloudFormation; Bicep or GCP Deployment Manager is advantageous.
• Scripting and automation experience; Python is preferred.
• Experience operating a CNAPP or CSPM platform; Wiz is preferred.
• Understanding of vulnerability management, logging and detection, secrets management, and incident support.
• Familiarity with container and Kubernetes security; AI/ML application security is desirable.
• At least four years of experience in DevSecOps, application security, or cloud security engineering.
• Exposure to SOC 2, ISO 27001, or SOX.
• Relevant professional security certification, such as GWEB, Certified DevSecOps Professional, or AWS Certified Security – Specialty.

Responsibilities

• Mature the DevSecOps program and embed SAST, DAST, SCA, infrastructure-as-code scanning, secrets scanning, and policy gates into CI/CD pipelines.
• Threat-model new services and features with application teams and provide actionable guardrails and remediation guidance.
• Build secure-by-default patterns, reusable infrastructure-as-code modules, and golden pipeline templates.
• Operate Wiz to triage, prioritize, and remediate cloud and application findings.
• Establish cloud security guardrails across AWS and extend posture management to Azure and equivalent GCP controls.
• Harden cloud identity, access, and network exposure.
• Reduce critical and high-severity findings across public-facing workloads and applications.
• Provide security controls and evidence for SOC 2, audits, and regulatory requirements.

Skills

Certifications

Degrees

Industry

Relocation