DevSecOps Engineer

Quick Facts

• Role: DevSecOps and Vulnerability Management Engineer

• Focus: CI/CD security, unified vulnerability triage & tracking, vulnerability reporting

• Level: 8+ years experience

Description

Strengthen security practices across development pipelines, cloud infrastructure, and vulnerability management processes. You will assess and improve CI/CD security, establish unified vulnerability triage and tracking, and deliver clear metrics and weekly reporting to senior leadership. During a later phase, you will lead cloud and infrastructure engineering activities and vulnerability operations within the DevOps team.

Responsibilities

• Assess existing CI/CD pipelines and tools (GitHub Actions, Jenkins with Groovy, ArgoCD, Helm, AWS CodePipeline) and evaluate current security scanning effectiveness.

• Design and implement a unified vulnerability triage process to consolidate findings, remove duplicates, and prioritize risk using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.

• Implement end-to-end vulnerability tracking with assigned owners and documented resolution status (remediated, contained, or risk-accepted).

• Integrate SAST, SCA, secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines with security gates to prevent regression.

• Define and enforce branch management and repository hygiene practices to reduce accumulated vulnerabilities and control finding growth.

• Produce regular vulnerability management reports and progress metrics for the CISO and senior leadership, including accurate weekly reporting.

• Coordinate remediation activities across engineering teams and translate technical findings into actionable information for non-technical stakeholders.

• During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within DevOps.

Requirements

• 8+ years of experience in DevOps or platform engineering with substantial practical DevSecOps expertise.

• Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.

• Hands-on experience managing vulnerabilities at scale (aggregation, deduplication, risk-based prioritization, remediation tracking).

• Strong knowledge of vulnerability scoring/prioritization frameworks including CVSS, EPSS, and CISA KEV (plus exploitability/reachability concepts).

• Ability to prepare concise, reliable reporting for senior management and non-technical stakeholders.

• Ability to coordinate cross-team security remediation and lead technical initiatives.

• Comfort working in environments using Java, .NET, Node.js/TypeScript, Ruby, and PHP.

Preferred: experience with vulnerability aggregation platforms such as DefectDojo; container and Kubernetes security; SBOM and software supply chain practices (SLSA, Sigstore); Azure DevOps or AWS CodePipeline; security reporting dashboards in Power BI or Datadog.

Benefits

• Opportunity to join and shape a dedicated security team for a high-impact SaaS provider serving public-sector clients across North America.

• Remote work.

• TEAL culture valuing relationships and respect.

• Integration trips to various places in Europe.

• Activities to support well-being and health.

• Luxmed Gold extended medical care and Multisport Plus benefits.