Engineer II - DevSecOps

Exelixis•Alameda, CA

5d•$173,000 - $220,000

About The Position

The Engineer II - DevSecOps protects the organization's AI infrastructure, data, and systems from internal and external cybersecurity threats by implementing, managing, and continuously improving security practices, tools, and operations, with a focus on AI, cloud applications, and infrastructure. The role develops AI-assisted security automation, secure software delivery pipelines, and operational DevSecOps capabilities. It builds and maintains software components, scripts, prompts, workflows, integrations, tests, and security controls across development and cloud environments, while applying appropriate human review, testing, governance, logging, observability, and data protection. The position provides DevSecOps and cybersecurity expertise to internal teams, vendors, and partners; investigates security events and vulnerabilities; and implements risk-based remediation. It collaborates across engineering, infrastructure, data, and business teams to incorporate security into technology initiatives and the software development lifecycle. The role applies Exelixis and industry security practices in a regulated environment, including applicable SOX, FDA, privacy, and data protection requirements. It has no supervisory responsibilities and requires up to 5% travel. The position is located in Alameda, California. The base salary range is $173,000–$220,000. The office is described as a modern collaborative space, with necessary equipment including dual monitors and ergonomic chairs.

Requirements

Bachelor’s degree in a related discipline and 5 years of related experience; or a master’s degree in a related discipline and 3 years of related experience; or an equivalent combination of education and experience.
Experience developing and maintaining software, automation, or infrastructure solutions in an enterprise environment.
Experience integrating security controls into cloud platforms, applications, APIs, infrastructure as code, and CI/CD pipelines.
Experience with cloud, AI systems, application security, vulnerability management, and secure software development practices.
Experience operating or implementing cybersecurity and DevSecOps tools, including source control, build and deployment tooling, security testing, secrets management, and logging or monitoring.
Experience investigating and remediating security findings or events involving applications, cloud services, development pipelines, or access controls.
Experience working in Agile environments and using work management and service management tools such as JIRA and JSM.
Experience collaborating with engineering, infrastructure, security, vendors, and business stakeholders to deliver secure technology solutions.
Proficiency with a scripting or programming language such as Python, PowerShell, JavaScript/TypeScript, or Java, and with command-line tooling.
Knowledge of enterprise applications, infrastructure, cloud architecture, and common cybersecurity controls.
Working knowledge of AI, machine learning, generative AI, LLMs, prompt engineering, agent workflows, retrieval-assisted systems, and responsible AI practices.
Knowledge of AWS and cloud security concepts, including IAM, network controls, encryption, secrets management, logging, and secure configuration.
Knowledge of infrastructure as code, secure SDLC, CI/CD pipelines, source control, automated testing, software supply chain security, and vulnerability remediation.
Understanding of application, API, container, and cloud security principles, including threat modeling and risk-based control selection.
Ability to use AI-assisted development tools responsibly and validate generated code, prompts, configurations, and automated actions.
Strong analytical, troubleshooting, organizational, documentation, and communication skills.
Ability to work effectively with technical and non-technical stakeholders while balancing confidentiality, integrity, availability, privacy, and business needs.
Ability to manage multiple priorities, work through ambiguity, protect confidential data, and deliver reliable results with limited guidance.
Working knowledge of PII, PHI, sensitive data, and applicable privacy and security requirements, including GDPR and CPRA.
Ability to travel up to 5%.

Nice To Haves

Experience in regulated industries, such as biotechnology or pharmaceuticals, with knowledge of GxP, SOX, privacy, or related compliance requirements.

Responsibilities

Develop AI-assisted security automation, secure software delivery pipelines, and operational DevSecOps capabilities.
Design and implement software components, scripts, prompts, test cases, and configuration changes that integrate security controls into development and cloud workflows.
Use and extend approved AI-assisted development tools, including coding copilots and agentic coding tools, while applying human review, testing, and governance.
Provide DevSecOps and cybersecurity expertise to internal teams, vendors, and partners; independently resolve moderately complex security questions and escalate high-risk issues as appropriate.
Develop, integrate, and maintain prompts, agent workflows, retrieval-assisted use cases, and API integrations with appropriate security controls, logging, observability, and data protection.
Develop and maintain automated unit, integration, security, and pipeline tests; troubleshoot failures, remediate defects, and improve validation coverage.
Maintain technical documentation, including architecture and design summaries, prompt and specification notes, deployment procedures, user guidance, and operational runbooks.
Contribute to code reviews, threat modeling, design reviews, demos, testing sessions, backlog refinement, and team learning activities.
Identify weaknesses and vulnerabilities in applications, cloud platforms, AI systems, and delivery pipelines; implement risk-based remediation and security improvements.
Implement and improve security controls and guardrails across CI/CD pipelines, infrastructure as code, cloud services, applications, APIs, AI systems, and development tooling.
Partner with engineering, infrastructure, data, and business teams to integrate security requirements into technology initiatives and the software development lifecycle.
Investigate and respond to security events involving applications, cloud environments, development pipelines, credentials, APIs, and AI systems; document findings and support containment and remediation.
Monitor and analyze security logs, pipeline results, vulnerability findings, and telemetry to identify anomalous activity, control gaps, and opportunities for automation.
Evaluate emerging cybersecurity, cloud, AI, and software supply chain risks; recommend practical controls and incorporate approved improvements into DevSecOps processes.
Apply Exelixis and industry security practices in a regulated environment, including applicable SOX, FDA, privacy, and data protection requirements.
Perform other duties as assigned and comply with all policies and standards.

Benefits

401(k) plan with generous company contributions.
Group medical, dental, and vision coverage.
Life and disability insurance.
Flexible spending accounts.
Eligibility for a discretionary annual bonus program, or a sales-based incentive plan for field sales staff.
Opportunity to purchase company stock.
Long-term incentives.
15 accrued vacation days in the first year.
17 paid holidays, including a company-wide winter shutdown in December.
Up to 10 sick days throughout the calendar year.