Senior DevSecOps Engineer

Lam Research•Waltham, MA

13d

About The Position

Within Semiverse® Solutions at Lam Research, the Senior DevSecOps Engineer is part of the Engineering Operations team and owns the security health of desktop software products, web applications, and development pipelines. The role upgrades third-party and open-source dependencies in product code, runs automated tests, and troubleshoots compatibility issues. It also maintains security scanning integrated into CI/CD pipelines and works with Product Security Engineers and Application Security Engineers in central InfoSec to guide products through a Secure Software Development Lifecycle (SDLC). This senior-level role offers opportunities to independently drive projects to completion and pursue technical career growth.

Requirements

Be a team player who enjoys supporting and working with others.
Have a systematic work style and excellent attention to detail.
Have a bachelor's degree in Computer Science or a related field and at least 8 years of professional experience, a master's degree and at least 6 years, or an associate degree or equivalent technical background and at least 10 years, in software engineering, DevOps, or application security.
Be proficient with Git and source code management platforms such as Bitbucket, GitHub, or Azure Repos.
Be proficient in both Windows and Linux environments.
Have strong Python skills, including dependency management with pip, virtual environments, requirements and lock files, and the ability to read and modify production code.
Be proficient with CI/CD tools such as Jenkins, Azure DevOps, or GitHub Actions.
Have proven experience upgrading third-party dependencies in an existing codebase and resolving resulting build, API, and test failures.
Have hands-on experience with SCA and SAST tools such as Black Duck and SonarQube, including triaging findings and identifying false positives.
Have working knowledge of Secure SDLC practices and vulnerability standards such as CVE, CVSS, and the OWASP Top 10.
Have clear written communication skills for preparing security documentation and working with security teams.

Nice To Haves

Experience with containerization technologies such as Docker or Kubernetes.
Experience with repository managers such as Artifactory.
Experience with cloud computing services such as Azure, AWS, or GCP.
Experience with C++ and build systems such as gmake, scons, or cmake.
Experience with DAST tools such as Invicti.
Experience generating and managing SBOMs in standard formats such as SPDX or CycloneDX.
Understanding of open-source license compliance.
Experience supporting application security reviews, threat modeling, or penetration test remediation.
Familiarity with Python scientific and engineering libraries.
Experience managing JavaScript/TypeScript dependencies with npm, including upgrades in Angular applications.

Responsibilities

Remediate vulnerabilities in third-party and open-source dependencies identified by SCA and SAST scans by opening and testing pull requests against product code.
Run automated test suites and troubleshoot build and compatibility issues caused by dependency upgrades, collaborating with developers when deeper product expertise is needed.
Reduce outstanding security exceptions by identifying upgrade paths, replacement components, or mitigations for vulnerable dependencies.
Maintain and improve SAST, SCA, and DAST scanning and its integration into CI/CD pipelines, including scan templates, quality gates, and policies.
Generate and maintain Software Bills of Materials (SBOMs) and support vulnerability tracking and handling for released products.
Serve as the primary point of contact between Engineering and InfoSec, coordinating risk assessments, architecture and infrastructure reviews, and security exception requests by gathering development-team input and tracking reviews through approval.
Partner with Application Security Engineers on DAST and penetration testing, helping developers interpret findings and track remediation.