DevSecOps Engineer
Core
Embed automated security into software delivery by integrating security scanning and risk-based gates into CI/CD workflows for product and internal engineering teams.
Role type
hands-on DevSecOps engineer
Builds
reusable security controls, developer-friendly feedback loops, and measurable security outcomes
Domain
cybersecurity, software development lifecycle (SDLC), cloud infrastructure
Required skills
CI/CD pipeline automation, security scanning (SAST, SCA, secrets, containers, IaC, DAST), scripting (Python, Bash), API integration, vulnerability triage and remediation, Secure SDLC practices, Linux, cloud fundamentals, OWASP Top 10
Preferred skills
Kubernetes, Terraform, AWS/Azure, SBOM, software supply-chain security, signing/attestation, AI-assisted SDLC tools
Technologies
GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CodeQL, Semgrep, SonarQube, Snyk, Trivy, Gitleaks, Checkov, ZAP
Responsibilities
Integrate secret scanning, SAST, SCA/SBOM, container, IaC, and DAST checks into pull request, build, and release workflows; Implement risk-based CI/CD security gates and manage false-positive handling; Build scripts and API integrations for scan aggregation, ticketing, evidence collection, and security reporting; Maintain visibility into scan coverage, gate decisions, vulnerability trends, and control adoption; Enable Product Security, Security Champions, and SRE teams using AI tools for analysis and scripting
Seniority
Mid-level, hands-on IC