DevSecOps Engineer - Information Security

Elevance Health•Durham, NC

8d•Hybrid

About The Position

The DevSecOps Engineer develops, recommends, and implements enterprise information security policies, technical standards, guidelines, procedures, and infrastructure in compliance with company policies, regulatory requirements, and generally accepted security controls. This individual contributor leads the design and integration of DevSecOps, Application Security, and Vulnerability Management capabilities across the enterprise, embedding secure-by-design practices in CI/CD pipelines, cloud-native platforms, modern development workflows, and AI-assisted coding environments. The role partners with application engineering, cloud, and platform teams to deliver scalable, automated security controls while enabling developer velocity. The position is hybrid and requires associates to work in-office one to two days per week. Candidates must live within reasonable commuting distance of a posting location unless an accommodation is granted. The role is not eligible for current or future visa sponsorship and is classified as Non-Management Exempt, 1st Shift.

Requirements

Bachelor's degree in Information Technology or a related field and at least 8 years of experience in systems administration and security aspects of information systems, access management and network security technologies, network communications, computer networking, telecommunications, systems development and management, hardware, software, data, and people; experience across multiple technical and business disciplines is required. An equivalent combination of education and experience may be accepted.
Experience with vulnerability management and risk prioritization.
Strong knowledge of Application Security, including SAST, DAST, SCA, and API security, and Cloud Security across AWS, Azure, or GCP, as well as container and Kubernetes security.
Experience in DevSecOps, Application Security, Cloud Security, or related fields.
Hands-on experience integrating security into CI/CD pipelines at scale.
Strong understanding of DevOps and Agile practices.
Must reside within reasonable commuting distance of a posting location unless an accommodation is granted.
Must not require current or future visa sponsorship.

Nice To Haves

Experience with Harness pipelines.
Experience with CNAPP platforms such as Wiz or Prisma Cloud.
Experience with Snyk, Checkmarx, Veracode, or SonarQube.
Experience with JFrog Artifactory, Xray, and Curation.
Experience securing AI/LLM-enabled applications or AI-assisted development workflows.
Familiarity with AI security risks, including OWASP Top 10 for LLMs, prompt injection, and data leakage.
Security certifications such as CISSP, CCSP, or CSSLP.

Responsibilities

Define and implement secure SDLC practices, including automated testing, threat modeling, and secure coding standards.
Drive vulnerability management strategy, including risk-based prioritization and integration into developer workflows.
Lead development and execution of risk assessment methodologies tailored to business, regulatory, and technical considerations.
Lead development of requirements, system architecture, and software design for security products and services.
Lead system and network architecture support for information and network security technologies.
Serve as a technical advisor and escalation point for complex security and integration challenges.
Develop security incident response plans and strategies.
Troubleshoot complex problems and serve as a point of technical escalation.
Act as a subject matter expert among peers, managers, and senior management.
Design and implement DevSecOps solutions integrated into CI/CD pipelines, including GitHub, GitLab, and Jenkins.
Integrate and tune AppSec tools, including SAST, DAST, SCA, and container scanning, for scalable pipeline adoption.
Own and optimize CNAPP platforms such as Wiz and Prisma Cloud to improve cloud security posture and workload protection.
Partner with engineering teams to reduce vulnerability backlog and mean time to remediation (MTTR).
Define KPIs and reporting for security posture, pipeline coverage, and risk reduction.
Establish guardrails for AI-generated code security, including output validation and mitigation of insecure code patterns and data exposure.
Embed security controls into AI-enabled applications and APIs, addressing risks such as prompt injection and model misuse.
Create presentations and seek IT management approval for significant replacements or reconfigurations of major enterprise security systems.