DevSecOps and AI/Automation Engineer

Altera Semiconductor•San Jose, CA

1d•Onsite

About The Position

The AppSec / DevSecOps Engineer will help strengthen application and software supply chain security across a global semiconductor organization. This role will embed security into the software development lifecycle through secure design, application security assessments, automated security testing, CI/CD security controls, developer enablement, and continuous improvement. The role will support enterprise applications and digital platforms used across business operations, application development, engineering enablement, supply chain, intellectual property, corporate functions, and customer-facing services. The successful candidate will combine application security expertise with practical DevSecOps engineering, automation, risk-based assessment, and strong collaboration with development and technology teams. The Application Security and DevSecOps team helps protect the company’s software, engineering platforms, cloud services, intellectual property, and business applications by embedding security throughout the development lifecycle. The team works across product, application development, IT, cloud, infrastructure, supply chain, corporate technology, and other business functions to improve secure development practices, automate security controls, and reduce application and software supply chain risk.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Engineering, Information Systems, or a related technical discipline; equivalent experience may be considered.
6+ years of professional experience in AppSec, DevSecOps, secure SDLC, cloud security, cybersecurity engineering, software security, or a related discipline.
Hands-on experience with secure SDLC, application security, secure-by-design, or DevSecOps activities.
Experience with CI/CD or modern software engineering environments.
Experience with at least three of the following: SAST, DAST, SCA, secrets scanning, IaC scanning, container security, API security, threat modeling, or vulnerability management.
Experience translating cybersecurity policies, standards, or control requirements into technical controls, engineering requirements, security procedures, or SDLC workflows.
Experience with at least one cloud or cloud-native environment, including Microsoft Azure, AWS, Kubernetes, or container-based application environments.
Experience using engineering, security workflow, or automation platforms such as Azure DevOps, GitHub, GitLab, Jenkins, Jira, or ServiceNow.
Ability to conduct or support application security assessments and communicate findings to technical and nontechnical stakeholders.
Strong written and verbal communication skills, attention to detail, and ability to manage multiple priorities.
Ability to work independently and collaborate effectively across geographically distributed teams.

Nice To Haves

Experience supporting complex global, high-technology, regulated, or intellectual-property-intensive organizations.
Experience securing enterprise applications, developer platforms, cloud services, source code repositories, business-critical systems, product lifecycle platforms, or intellectual property systems.
Experience with Checkmarx, Fortify, Veracode, Semgrep, GitHub Advanced Security, CodeQL, SonarQube, Snyk, Mend, Black Duck, or comparable tools.
Experience with Burp Suite, OWASP ZAP, Invicti, or comparable DAST and API security tools.
Experience securing containers, Kubernetes, serverless applications, APIs, and infrastructure-as-code.
Experience with Azure DevOps, GitHub Actions, GitLab CI/CD, Jenkins, Bitbucket, Argo CD, or comparable platforms.
Familiarity with OWASP Top 10, OWASP ASVS, OWASP SAMM, NIST SSDF, BSIMM, SLSA, CIS Controls, or similar frameworks.
Experience with SBOM, software provenance, artifact integrity, code signing, PKI, HSM, or dependency governance.
Experience developing application security dashboards, key risk indicators, key performance indicators, and executive reporting.
Experience with AI-enabled cybersecurity, secure AI development, or AI-assisted security automation.
Application Security: Threat modeling, secure code review, architecture review, penetration-test coordination, OWASP Top 10, OWASP ASVS, API security, and vulnerability management.
Security Testing: SAST, DAST, SCA, secrets detection, IaC scanning, container scanning, fuzzing, and dynamic API testing.
CI/CD: Azure DevOps, GitHub Actions, GitLab, Jenkins, Bitbucket, Argo CD, build pipelines, release gates, and deployment automation.
Cloud Security: Microsoft Azure, AWS, cloud-native workloads, serverless services, Kubernetes, containers, IAM, logging, and workload protection.
Software Supply Chain: SBOM, SLSA, dependency governance, artifact integrity, code signing, software provenance, PKI, and HSM.
Automation: Python, PowerShell, Bash, REST APIs, JSON, YAML, webhooks, workflow automation, and security-tool integrations.
Platforms: Jira, ServiceNow, Microsoft Power BI, Tableau, GitHub, GitLab, and comparable reporting or workflow platforms.
Frameworks: NIST SSDF, NIST CSF, OWASP SAMM, BSIMM, CIS Controls, ISO/IEC 27001, and applicable SOX/ITGC requirements.
A relevant certification is preferred but not required. Examples include: Certified Secure Software Lifecycle Professional — CSSLP GIAC Web Application Penetration Tester — GWAPT GIAC Web Application Defender — GWEB Offensive Security Web Expert — OSWE Offensive Security Certified Professional — OSCP Certified Information Systems Security Professional — CISSP Certified Cloud Security Professional — CCSP Microsoft Certified: Cybersecurity Architect Expert AWS Certified Security — Specialty Relevant application security, cloud security, or DevSecOps certification
Equivalent hands-on experience may be considered in lieu of certification.

Responsibilities

Define and maintain secure software development lifecycle standards, procedures, control requirements, and developer guidance.
Embed security requirements across planning, architecture, design, coding, testing, release, deployment, and operations.
Develop security gates based on application risk, data sensitivity, business criticality, and deployment model.
Support secure architecture reviews, threat modeling, security requirements definition, and go-live risk assessments.
Establish secure coding standards for common programming languages, frameworks, APIs, cloud services, and development patterns.
Track security findings, remediation commitments, exceptions, compensating controls, and risk acceptance decisions.
Measure improvements in secure SDLC adoption, remediation timeliness, control coverage, and recurring vulnerability reduction.
Implement and operate SAST, DAST, software composition analysis, secrets detection, container scanning, API security, and infrastructure-as-code scanning.
Integrate security tooling into CI/CD pipelines using standardized patterns, APIs, plugins, connectors, and workflow automation.
Configure security gates, severity thresholds, suppression processes, exception workflows, and escalation paths.
Monitor tool health, scan coverage, pipeline failures, vulnerability backlogs, critical findings, and remediation performance.
Tune security tooling to improve finding accuracy, reduce false positives, and minimize unnecessary development disruption.
Establish processes for tool onboarding, configuration management, testing, upgrades, support, and retirement.
Develop reusable integrations, scripts, dashboards, reference implementations, and automation assets.
Support AI-assisted vulnerability triage, remediation recommendations, validation, and security workflow automation where appropriate.
Perform application security assessments across web applications, APIs, microservices, mobile applications, cloud services, developer platforms, and engineering systems.
Conduct threat modeling, secure design reviews, architecture assessments, code reviews, vulnerability analysis, and penetration-test coordination.
Assess enterprise and business-critical applications, including web applications, APIs, cloud services, developer platforms, source code repositories, product lifecycle systems, supply chain platforms, and intellectual property systems.
Identify vulnerabilities, attack paths, insecure dependencies, authentication weaknesses, authorization issues, exposed secrets, and data protection risks.
Translate findings into practical remediation plans with severity, business impact, recommended actions, owners, and due dates.
Validate remediation through retesting, automated verification, evidence review, or compensating-control assessment.
Maintain application security risk registers and report material risks, aging findings, exceptions, and residual exposure.
Support security reviews for major application changes, cloud migrations, acquisitions, third-party platforms, and new technologies.
Support secure development and deployment practices across Microsoft Azure, AWS, and hybrid environments.
Assess cloud-native services, containers, Kubernetes, serverless workloads, APIs, infrastructure-as-code, and CI/CD pipelines.
Implement controls for open-source dependencies, software bills of materials, artifact integrity, code signing, build security, secrets protection, and software provenance.
Partner with Cloud Engineering and DevOps teams to embed security checks into infrastructure provisioning and deployment workflows.
Identify and remediate vulnerable dependencies, exposed secrets, insecure configurations, and compromised build components.
Contribute to secure cloud application standards, reference architectures, and DevSecOps patterns.
Partner with software developers, architects, DevOps engineers, product owners, cloud teams, infrastructure teams, and enterprise technology organizations.
Provide practical guidance on secure coding, authentication, authorization, API security, secrets management, dependency risk, and cloud-native security.
Develop training, workshops, office hours, knowledge articles, remediation playbooks, and secure coding guidance.
Support developers in interpreting scan results and resolving complex or recurring vulnerabilities.
Contribute to security champion programs and communities of practice.
Promote security-by-design while enabling efficient software delivery and engineering productivity.
Develop dashboards and reports covering: SAST, DAST, SCA, secrets, and IaC scanning coverage, Critical and high-severity vulnerability aging, Remediation service-level performance, CI/CD security-gate adoption, Application assessment completion, Exception volume and aging, Tool health and scan reliability, Secure SDLC maturity, Developer training and adoption.
Conduct quality reviews of assessment reports, scan results, remediation evidence, exceptions, and control performance.
Identify improvements in automation, data quality, developer experience, tool effectiveness, and program maturity.
Independently own assigned AppSec, DevSecOps, tooling, assessment, and remediation workstreams.
Deliver high-quality technical analysis, documentation, automation, and recommendations with limited supervision.
Build reusable security engineering assets and share knowledge across development and security teams.
Manage workstream priorities, risks, dependencies, deliverables, and stakeholder expectations.
Exercise sound judgment when evaluating vulnerabilities, exceptions, compensating controls, and business risk.
Mentor developers and security practitioners through technical guidance, workshops, code reviews, and knowledge sharing.
Maintain current knowledge of application security threats, cloud technologies, development practices, and security tooling.
Promote a practical, collaborative, and outcomes-focused security culture.