Senior / Staff DevSecOps Engineer

Twenty • Arlington, VA

13d • $159,000 - $263,000 • Onsite

About The Position

This role involves building and owning the security infrastructure that keeps Twenty's engineering systems safe without slowing engineers down. The position spans runtime security, access control, secrets management, compliance, and CI/CD hardening, with an emphasis on making security the path of least resistance. The engineer will embed with engineering teams, design secure-by-default foundations, and build tooling and automation to enable rapid development without compromising security. This role reports directly to the VP of Engineering and functions as a shared resource across product teams.

Requirements

• 8+ years in DevSecOps, platform security, or a closely related security engineering role.
• Deep hands-on experience with AWS — IAM, SCPs, Organizations, security services (GuardDuty, Security Hub, CloudTrail, etc.).
• Strong IaC experience with Terraform; you've used it to enforce security controls, not just provision infrastructure — and you've layered in policy-as-code tooling (e.g., OPA, Checkov, tfsec) or continuous compliance checks (e.g., AWS Config Rules) to catch drift and misconfigurations.
• Experience owning secrets management end-to-end in a production engineering environment.
• Proven track record designing and hardening CI/CD pipelines (we use GitHub Actions).
• Hands-on experience with container security, including image scanning and runtime controls.
• Experience leading or meaningfully contributing to a compliance program; CMMC Level 2 (or NIST SP 800-171) experience strongly preferred.
• You've run incident response — you've been on call, you've led the post-mortem, and you've shipped the fix.
• Strong communication skills and the ability to drive security adoption through enablement, not mandates.
• U.S. Citizenship Required / No Active Clearance Required
• Eligibility to obtain and maintain a U.S. Government security clearance.

Nice To Haves

• Experience growing a DSO or security engineering function — expanding scope, tooling, and team.
• Familiarity with observability tooling and using it for security signal (we use the LGTM stack).
• Background in configuration management tooling (Ansible or similar).
• Experience with developer-facing security platforms or internal tooling that improved engineering workflows.
• Interest in growing into a lead or manager role as the team scales.

Responsibilities

• Own runtime security and vulnerability management across cloud and container environments, including triage, prioritization, and remediation tracking.
• Design and enforce identity and access management (IAM) across AWS and internal systems — least-privilege by default.
• Own secrets and credentials management: policies, tooling, rotation, and developer workflows that make doing the right thing easy.
• Lead security incident response: detection, containment, root cause analysis, and durable remediation.
• Manage AWS Organization structure, account boundaries, SCPs, and guardrails.
• Harden and maintain CI/CD pipelines, embedding security scanning and policy enforcement into the software delivery lifecycle.
• Drive compliance efforts — own the evidence, controls, and remediation work to meet and maintain relevant frameworks.
• Build and maintain secure-by-default templates for repos, pipelines, and infrastructure modules.
• Reduce friction through automation: certificate issuance, secrets access, policy-as-code, and developer-facing tooling.
• Produce lightweight, practical security guidance that engineers actually use.
• Shape the direction of the DSO function as it scales, and contribute to hiring and team-building as we grow.

Benefits

• Medical, dental, and vision plan options.
• Life / AD&D, disability coverage options.
• Paid parental leave for eligible full-time employees. 12 weeks for birthing parents, 4 for non-birthing parents, 6 weeks for adoptive, foster, or intended parents through surrogacy.
• Paid holidays and flexible PTO.
• 401(k) with pre-tax and Roth options.
• HSA/FSA options, dependent care FSA.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed