Senior Manager DevSecOps

SAS•Cary, NC

8d•Hybrid

About The Position

The Senior Manager, DevSecOps will lead SAS's DevSecOps team and shape how security is integrated across Global Engineering and R&D. The team enables secure, reliable software delivery at scale through modern tooling, automation, security architecture, vulnerability management, and offensive security practices. Working with engineering, product, governance, and security partners, this leader will develop a strategy that makes secure practices easier to adopt, reduces friction for developers, and improves the organization's ability to identify, prioritize, and address risk. The role translates security objectives into measurable engineering outcomes, builds and develops a high-performing team, establishes scalable security capabilities, and influences engineering practices across a large, distributed organization. Success includes reducing risk while establishing transparent, automated, sustainable security practices that development teams adopt and embed in the software delivery lifecycle. The position is hybrid in Cary, North Carolina.

Requirements

At least 10 years of related programming or security experience, including three years of project lead, supervisory, or management experience.
Bachelor's degree with a major in Computer Science, Electrical Engineering, or a related field; an equivalent combination of related education, training, and experience may be considered.
Extensive hands-on experience in product security, application security, or software security engineering, with a record of meaningful impact beyond process compliance.
Deep technical understanding of modern software architectures, cloud platforms, and enterprise SaaS deployment models, sufficient to evaluate security findings in architectural context.
Proven experience in threat intelligence, CVE management, and security incident response, including hands-on involvement in active incidents.
Exceptional communication skills, including the ability to brief executives and provide precise guidance to engineers.
Experience influencing stakeholders outside the candidate's team and business unit.
Accountability for the software lifecycle, customer-impacting issues, and continuous improvement.

Nice To Haves

Relevant security certifications, such as GIAC certifications, CEH, CCSP, CSSLP, CISM, or CISSP.
Ability to drive alignment on security priorities across large, distributed engineering organizations.
Architectural fluency, including understanding the systems being secured and knowing when deeper investigation is needed before evaluating a finding.
People-development skills, including setting direction for experts, evaluating their work, and helping practitioners become more effective.
Background in penetration-testing leadership, offensive security, or red-team operations.
Experience with supply-chain security, SBOM, and third-party risk management.
Expertise in securing enterprise web applications and familiarity with OWASP Top 10, CVSS, CWE, and SANS-25.
Familiarity with security governance frameworks and ISMS participation.
Recognized security-community thought leadership, such as publications, conference contributions, or open-source work.

Responsibilities

Lead and mentor a talented and diverse team of engineers and security professionals.
Advocate for best practices and continuous improvement across the team, department, and engineering organization.
Monitor the external threat environment, including CVEs, industry incidents, emerging attack patterns, and regulatory shifts, and brief engineering leadership on relevant developments.
Help design and deliver a modern, automated security platform for risk assessment, vulnerability management, and remediation assistance while reducing engineering toil.
Establish practices and enablement to ensure applicable security policies and processes are followed in support of secure software development goals.
Build a model for iterative, continuous improvement in security practice maturity and posture.
Build partnerships with security leaders and stakeholders across the company to respond to incidents and risks, and lead a unified approach to security solutions.
Translate security objectives into measurable engineering outcomes and promote secure practices embedded in the software delivery lifecycle.

Benefits

Comprehensive medical, prescription, dental, and vision plans.
PPO medical plan option with a low annual deductible and copays.
HDHP medical plan option combined with a health savings account and a contribution from SAS.
Onsite health care center at headquarters, free to employees and family members enrolled in the PPO plan.
Pharmacy services, including prescription shipping at no additional charge.
Industry-leading 401(k) plan.
Tuition Assistance Program and development programs and resources.
Vacation time and a variety of paid holidays.
U.S. Winter Wellness Break between December 25 and January 1.
Volunteer Time Off.
Parental leave.
Unlimited paid sick days.
Childcare benefits for full-time employees.