DevSecOps Engineer

Casa

44d•$125,000 - $155,000•Remote

About The Position

Casa is looking for a DevSecOps Engineer to help secure our customers, their data, and our company. As a member of our Security team, you will report to our Chief Security Officer and play a crucial role in overseeing our security architecture and culture. It will also be a unique opportunity to help develop an evolving security program consisting of efficient processes, training materials, and methodologies for all employees. The successful candidate has experience developing scalable security controls and approaches in accordance with industry standards.

Requirements

Security certifications or equivalent real-world experience
Think like an attacker, and a hacker mindset is genuinely how you approach problems
Deep background across multiple facets of security
5+ years implementing security in Linux-based infrastructures, AWS, and code
Comfortable with open-source tooling, cloud environments, and multiple operating systems
Experience building security solutions that actually scale
Hands-on with one or more of: penetration testing, threat modeling, code analysis, system hardening, distributed patching, vulnerability scanning
Familiar with hardening AI tooling to prevent security incidents
Strong communicator who can present findings to both technical and non-technical audiences

Nice To Haves

Experience or genuine interest in cryptocurrency / cryptography

Responsibilities

Handle internal security requests and make sure employees have the tools and access they need without over-provisioning
Ensure that employees have access to the tools and systems they need while maintaining least privilege access principles
Onboard and offboard employees across internal systems
Oversee our MDM system and stay on top of alerts
Review and assess new technologies (tools, code frameworks, third-party providers, internal apps) through a security lens
Help shape and refine security best practices across the org
Triage and work through vulnerabilities surfaced by pen testing, static analysis, responsible disclosures, and automated alerts
Keep security documentation and training materials fresh and useful
Automate security processes and alerts wherever you can find the leverage
Participate in a shared on-call rotation for critical production security issues
Stay abreast of the latest security events and trends
Participate in regular security training and certification acquisition
Ensure our software development lifecycle remains secure as we continue to evolve its processes.
Write infrastructure-as-code to automate deployment and management using Terraform, Ansible, or similar tools
Stay current on emerging threats, security trends, and what's happening across our stack and industry
Investigate and resolve infrastructure incidents to keep things running smoothly