Senior Software Security Architect

Direct Supply•Milwaukee, WI

About The Position

Direct Supply is building healthcare technology products, solutions and platforms intended to improve the lives of seniors and those who care for them. The Principal Cyber Security Engineer provides technical leadership and strategic direction for the company’s DevSecOps function, integrating security throughout the software development and delivery lifecycle. The role combines engineering expertise with ownership of DevSecOps capabilities, standards and technology to reduce security risk, improve development efficiency and enable secure, reliable software delivery. Reporting to the Director of Information Security, this principal technical contributor partners with engineering, technology and security teams to shape secure architectures, advance automation and deliver measurable security improvements. The position also provides technical guidance and limited supervisory support to strengthen DevSecOps capabilities across the organization.

Requirements

Bachelor's degree in Computer Science, Engineering, Information Security or a related field.
10+ years of progressive experience in information security, software engineering, platform engineering or DevSecOps, including technical leadership of complex security engineering initiatives.
Deep expertise across the software development lifecycle, including secure architecture, application security, automated testing, build and release processes, cloud security and production operations.
Hands-on experience designing and implementing security automation, integrating security testing tools into CI/CD pipelines, and securing cloud-native applications, containers and infrastructure environments.
Experience establishing DevSecOps roadmaps, technical standards and security capabilities that improve engineering practices, reduce risk and deliver measurable business results.
Strong knowledge of software supply chain security, secure development practices, threat modeling, vulnerability remediation and risk-based security controls.
Ability to independently resolve complex technical challenges, evaluate security trade-offs and influence engineering decisions across multiple teams.
Ability to communicate complex security risks, guide technical teams, mentor engineers and coordinate cross-functional initiatives.
Job is to be performed at the location listed; the posting does not specify the location.

Nice To Haves

CISSP, CCSP, GIAC or relevant cloud and DevSecOps certifications.
Experience securing AI/ML and generative AI solutions.

Responsibilities

Lead the DevSecOps function by defining and executing its technical strategy, roadmap and priorities.
Establish secure architecture and engineering standards, evaluate system designs, define reusable security patterns and advance threat modeling practices.
Implement secure coding practices, developer guidance, secrets detection and reusable automation.
Integrate SAST, SCA, DAST and infrastructure-as-code scanning into CI/CD pipelines, supporting improved vulnerability detection and risk-based releases.
Implement software supply chain security controls for build pipelines, artifact repositories, access management, secrets protection and software integrity.
Design and implement cloud and infrastructure security capabilities, including secure configurations, deployment patterns and automated controls.
Partner with engineering and operations teams to prioritize and remediate application and platform security risks, address recurring issues and verify corrective actions.
Collaborate with security operations teams on logging, monitoring, detection and incident response improvements.
Establish metrics for security coverage, tool adoption, remediation progress and control effectiveness, and use them to guide priorities and demonstrate results.
Evaluate security technologies, mentor engineers, guide assigned resources and support security champions.