DevSecOps Engineer

Overview

Embedded DevSecOps Engineer within a DevSecOps environment, responsible for proactively identifying, assessing, and remediating application security risks across the software development lifecycle.

What you'll do

• Analyze application designs and architectures to identify potential security risks and recommend secure design patterns
• Perform manual and automated code reviews to identify vulnerabilities and guide remediation
• Integrate and maintain application security tools within CI/CD pipelines for continuous testing
• Conduct application security testing (SAST, DAST, SCA, and penetration testing coordination)
• Manage vulnerability findings, including triage, prioritization, tracking, and coordination of remediation with development teams
• Partner with developers to implement secure coding practices and provide hands-on guidance and training
• Support application-level incident response, including investigation and remediation of security events
• Track and report vulnerability status and risk posture in formal reviews and program reporting
• Implement established security policies and recommend improvements
• Coordinate across teams to align DevSecOps activities with development roadmaps, releases, and operational priorities
• Facilitate daily scrum and sprint planning for DevSecOps
• Support Project Managers with unforeseen work/priorities entering the current team backlog and remove impediments from the team

What you'll need

• Bachelor's degree in Cybersecurity, Computer Science, or related field with 5+ years of experience (or equivalent experience); additional years of experience may be substituted in lieu of degree
• 5+ years of hands-on application security experience within a software development environment
• Experience integrating security into CI/CD pipelines and DevSecOps workflows
• Proven ability to manage and track vulnerabilities through remediation in collaboration with development teams
• Understanding of secure software development lifecycle (SDLC) principles
• Experience supporting or participating in security incident response
• Strong ability to communicate security risks and recommendations to technical teams
• Experience working in cross-functional environments with developers, architects, and operations teams
• Experience working in DevSecOps team with Agile development framework
• Must have US Citizenship

Nice to have

• Experience performing secure code reviews and identifying common vulnerabilities (e.g., OWASP Top 10)
• Experience with application security testing tools (SAST, DAST, SCA) and interpreting results
• Experience supporting federal or regulated environments (e.g., DOJ, FedRAMP, FISMA)
• Familiarity with threat modeling methodologies and secure architecture practices
• Experience with container and cloud security (e.g., Kubernetes, AWS, Azure)
• Knowledge of risk-based vulnerability prioritization and release gating practices

Details

• Location: Remote, US
• Pay range: $87,100.00 - $157,450.00