DevSecOps Engineer - Information Security

Elevance Health•Indianapolis, IN

6d•Hybrid

About The Position

The DevSecOps Engineer develops, recommends, and implements enterprise information security policies, technical standards, guidelines, procedures, and infrastructure in compliance with company policies, regulatory requirements, and generally accepted security controls. This individual-contributor role leads the design and integration of DevSecOps, Application Security, and Vulnerability Management capabilities across the enterprise, advancing secure-by-design practices across CI/CD pipelines, cloud-native platforms, modern development workflows, and AI-assisted coding environments. The engineer partners with application engineering, cloud, and platform teams to embed scalable, automated security controls that reduce risk while enabling developer velocity. The role leads secure SDLC and vulnerability management practices; designs and implements DevSecOps solutions and security tools; supports cloud, system, and network security architecture; and serves as a technical advisor and escalation point for complex security and integration challenges. It also establishes security guardrails for AI-generated code and AI-enabled applications, and develops metrics and reporting on security posture, pipeline coverage, and risk reduction. This is a hybrid role requiring associates to work in-office one to two days per week. Candidates must live within reasonable commuting distance of an office unless granted an accommodation. The position is not eligible for current or future visa sponsorship.

Requirements

Bachelor’s degree in Information Technology or a related field, and at least 8 years of experience in systems administration and information systems security, access management, network security technologies, network communications, computer networking, telecommunications, systems development and management, hardware, software, data, and people; or an equivalent combination of education and experience.
Experience across multiple technical and business disciplines.
Strong knowledge of Application Security, including SAST, DAST, SCA, and API security.
Knowledge of cloud security across AWS, Azure, or GCP, as well as container and Kubernetes security.
Hands-on experience integrating security into CI/CD pipelines at scale.
Strong understanding of DevOps and Agile practices.

Nice To Haves

Experience in DevSecOps, Application Security, Cloud Security, or related fields.
Experience with CNAPP platforms such as Wiz or Prisma Cloud.
Experience with tools such as Snyk, Checkmarx, Veracode, or SonarQube.
Experience with JFrog Artifactory, Xray, and Curation.
Experience securing AI/LLM-enabled applications or AI-assisted development workflows.
Familiarity with AI security risks, including OWASP Top 10 for LLMs, prompt injection, and data leakage.
Security certifications such as CISSP, CCSP, or CSSLP.

Responsibilities

Define and implement secure SDLC practices, including automated testing, threat modeling, and secure coding standards.
Drive vulnerability management strategy, including risk-based prioritization and integration into developer workflows.
Lead development and execution of risk assessment methodologies suited to business, regulatory, and technical considerations.
Lead development of requirements, system architecture, and software design for security products and services.
Provide system and network architecture support for information and network security technologies.
Serve as a technical advisor and escalation point for complex security and integration challenges.
Develop security incident response plans and strategies.
Resolve technical problems and provide escalation support for complex issues.
Act as a subject matter expert among peers, managers, and senior management.
Design and implement DevSecOps solutions integrated into CI/CD pipelines, including GitHub, GitLab, and Jenkins.
Integrate and tune application security tools, including SAST, DAST, SCA, and container scanning, for scalable pipeline adoption.
Own and optimize CNAPP platforms to improve cloud security posture and workload protection.
Partner with engineering teams to reduce vulnerability backlog and mean time to remediation (MTTR).
Define KPIs and reporting for security posture, pipeline coverage, and risk reduction.
Establish guardrails for AI-generated code, including output validation and mitigation of insecure code patterns and data exposure risks.
Embed security controls into AI-enabled applications and APIs, addressing risks such as prompt injection and model misuse.
Create presentations and obtain IT management approval for significant replacements or reconfigurations of major enterprise security systems.