DevSecOps Engineer

University of Chicago•Chicago, IL

12d

About The Position

The DevSecOps Engineer will streamline the secure software development life cycle, security automation and orchestration, and incident response from requirements through production monitoring. The role uses open-source tools, automation, and cloud resources to reduce repetitive work and support innovation. Systems to protect include on-premises infrastructure, custom SaaS tools for data sharing and analysis, and AI/ML research and bioinformatics environments. This at-will position is wholly or partially funded by contractual grant funding. Employment depends on continued receipt of grant funds and satisfactory job performance. The position is an individual-contributor role in the University of Chicago's Center for Translational Data Science. It is scheduled for 40 hours per week and is salary-based. The stated pay range is $80,000–$120,000. Benefits eligible. The University describes the Center for Translational Data Science as a research center focused on developing translational data science for impactful problems in biology, medicine, healthcare, and the environment. Its work includes building ecosystems of research data, computing resources, applications, tools, and services for the research community.

Requirements

College or university degree in a related field.
Knowledge and skills developed through 2–5 years of work experience in a related job discipline.

Nice To Haves

A recognized university degree in Computer Science, Computer/Electrical Engineering, Information Technology, or an equivalent field.
At least 2 years of experience developing infrastructure, system configuration, and/or deployment automation for one or more cloud platforms, including OpenStack, AWS, GCP, or Azure.
Technical experience with SAST, SCA, DAST, IAST, and other vulnerability scanning tools.
Experience performing secure code reviews and web application penetration tests.
Understanding of the full DevSecOps pipeline, Agile methodology, container security, APIs, and microservices.
Experience with CI/CD tools.
Experience using and protecting against AI/ML tools.
Familiarity with NIST 800-53, FedRAMP, FISMA, HIPPA, and other regulatory or industry requirements.
Experience with Palo XSOAR.
Certifications such as GWAPT, CEH, OSCP, or CISSP.
Curiosity and willingness to independently learn about emerging technologies and trends.
Ability to promptly respond to, triage, and resolve production incidents and events.
Ability to prioritize and manage workload to meet critical project milestones and deadlines.
Ability to balance business needs against security concerns.
Ability to plan and organize actions for successful completion, often under tight deadlines.
Ability to present information consistently and concisely.
Analytical thinking and excellent communication skills.
Proficient understanding of programming languages.
Scripting knowledge to support automation and continuous process improvement.
Knowledge of Python for using and developing a Security Orchestration, Automation, and Response platform.
Knowledge of build and release tools and methodologies in CI/CD pipelines, including Argo and Helm.
Ability to maintain confidentiality concerning sensitive matters, including strategic initiatives, trade secrets, quiet periods, and scientific discoveries not yet in the public domain.

Responsibilities

Evaluate and analyze the threat, vulnerability, impact, and risk of issues identified by security tools, including SAST, SCA, IAST, DAST, and container security platforms.
Design, develop, implement, and maintain security infrastructure for CTDS.
Advise and collaborate with DevOps teams, developers, application teams, and project teams on security issues, including technical details and vulnerability remediation.
Develop and design DevSecOps metrics, policies, processes, and procedures.
Train developers and other stakeholders in the use of security tools.
Assist with designing and implementing automated security checks and additional security tools in CI/CD pipelines.
Conduct proofs of concept and work with vendors on DevSecOps tools to improve security automation and efficiency.
Communicate effectively and manage stakeholder expectations.
Keep up with industry trends in security and DevSecOps and recommend continuous improvements.
Assist in maintaining FedRAMP Moderate and FISMA Moderate/Class C compliance.
Investigate, analyze, and resolve day-to-day technical problems using standard procedures.
Gather and analyze requirements with stakeholders for developmental programs.
Design applications to meet University and business requirements, receiving a moderate level of guidance.
Test code components and help ensure implementation standards are met.
Evaluate design alternatives based on development cost and potential solutions.
Support and maintain existing applications.
Work with developers and respond to user requests.
Perform other related work as needed.