DevSecOps Engineer

Renesas Electronics•Los Angeles, CA

1d•$150,000 - $160,000•Hybrid

About The Position

The DevSecOps Engineer secures the platform that hardware engineering teams trust to ship every day. You'll own the security engineering layer of Duro's modern stack—cloud security posture, detection and threat hunting, security telemetry, and the security infrastructure that protects multi-tenant, dedicated, and regulated (GovCloud/ITAR) environments. This is a security-first role on a small, fast-moving team reporting into the CISO organization, where you'll partner closely with platform engineering, product, and compliance to make security an accelerator rather than a gate. We're looking for an engineer who thinks in adversaries and systems, automates relentlessly, and leverages modern AI-augmented workflows to build defenses that scale. This is a hybrid role based in Los Angeles, CA (3 days per week in office).

Requirements

7+ years of hands-on experience in security engineering, cloud security, or DevSecOps with production ownership of security controls and infrastructure
Bachelor's degree in Computer Science or related field (or equivalent practical experience)
Deep AWS security expertise—IAM, KMS, VPC/network security, GuardDuty, Security Hub, CloudTrail, Config, WAF—including hands-on experience across commercial and GovCloud environments
Demonstrated experience in threat detection and threat hunting across cloud, application, and identity telemetry, including detection engineering / detection-as-code
Experience operationalizing threat intelligence to drive proactive defense
Strong background in logging, monitoring, and security reporting—centralized logging, SIEM design and administration, alerting, dashboards, and metrics
Experience implementing and administering security infrastructure and tooling (CSPM, vulnerability management, secrets management, workload/endpoint protection)
Application and pipeline security experience—securing CI/CD (GitHub Actions), SAST/DAST/SCA integration, secrets management, and securing containerized/Kubernetes workloads
Infrastructure-as-code proficiency with Terraform and containerization tools such as Docker, applied to security guardrails and controls
An innovative, adversarial mindset—you anticipate how systems break and automate the defense before it's needed
Strong systems thinking and the ability to design scalable, secure, maintainable controls
Excellent written and verbal communication skills
Comfort operating in autonomous, fast-paced environments

Nice To Haves

Relevant certifications (AWS Security Specialty, CISSP, OSCP, GCIH/GCIA/GCFA, or similar)
Experience with DuploCloud or similar tenant/cloud management platforms
Knowledge of compliance frameworks such as SOC 2, FedRAMP, ITAR, or CMMC
Experience building security for PLM, PDM, or hardware/manufacturing industry software
Background supporting compliance-driven or regulated (GovCloud, on-premises) deployments
Incident response, digital forensics, or purple-team experience
Familiarity with observability tooling such as Datadog, PostHog, or Sentry, and event-driven systems (NATS, Redis, Kafka)
PostgreSQL and Kubernetes operational familiarity sufficient to secure and reason about those workloads

Responsibilities

Design and operate the security posture of Duro's AWS commercial and GovCloud environments—IAM and least-privilege access models, KMS/encryption policy, VPC segmentation, network controls, and secure-by-default guardrails across accounts and tenants.
Proactively hunt across cloud, application, and identity telemetry for anomalous and adversarial behavior. Build and tune detections as code, reduce false positives, and turn hunt findings into durable, automated coverage.
Operationalize threat intelligence—integrate feeds, contextualize indicators and TTPs against Duro's attack surface, and drive proactive hardening ahead of emerging threats.
Architect and administer centralized logging, SIEM, and security monitoring across the stack. Own alerting pipelines, dashboards, and the security metrics and reporting that inform leadership, customers, and compliance evidence.
Implement, administer, and continuously improve the security tooling estate—CSPM, vulnerability management, endpoint and workload protection, secrets management, and cloud-native security services (GuardDuty, Security Hub, CloudTrail, Config, WAF, Inspector).
Embed security into the SDLC and CI/CD—secure GitHub Actions pipelines, integrate SAST/DAST/SCA, enforce secrets hygiene, and secure container and Kubernetes workloads from build through runtime.
Build reproducible, version-controlled security infrastructure and guardrails using Terraform, policy-as-code, and containerization—so controls are enforced automatically and drift is caught early.
Partner with CISO leadership to implement and evidence controls mapped to SOC 2, ITAR, and GovCloud requirements, translating framework obligations into concrete technical enforcement.
Leverage AI-augmented workflows to accelerate detection engineering, triage, and control implementation while maintaining rigorous validation and review standards.
Support detection, investigation, containment, and post-incident hardening—reducing mean time to detect and respond, and feeding lessons learned back into automated coverage.