Devsecops Engineer Jobs

About The Position

Requirements

• Be a team player who enjoys supporting and working with others.
• Have a systematic work style and excellent attention to detail.
• Have a bachelor's degree in Computer Science or a related field and at least 8 years of professional experience, a master's degree and at least 6 years, or an associate degree or equivalent technical background and at least 10 years, in software engineering, DevOps, or application security.
• Be proficient with Git and source code management platforms such as Bitbucket, GitHub, or Azure Repos.
• Be proficient in both Windows and Linux environments.
• Have strong Python skills, including dependency management with pip, virtual environments, requirements and lock files, and the ability to read and modify production code.
• Be proficient with CI/CD tools such as Jenkins, Azure DevOps, or GitHub Actions.
• Have proven experience upgrading third-party dependencies in an existing codebase and resolving resulting build, API, and test failures.
• Have hands-on experience with SCA and SAST tools such as Black Duck and SonarQube, including triaging findings and identifying false positives.
• Have working knowledge of Secure SDLC practices and vulnerability standards such as CVE, CVSS, and the OWASP Top 10.
• Have clear written communication skills for preparing security documentation and working with security teams.

Nice To Haves

• Experience with containerization technologies such as Docker or Kubernetes.
• Experience with repository managers such as Artifactory.
• Experience with cloud computing services such as Azure, AWS, or GCP.
• Experience with C++ and build systems such as gmake, scons, or cmake.
• Experience with DAST tools such as Invicti.
• Experience generating and managing SBOMs in standard formats such as SPDX or CycloneDX.
• Understanding of open-source license compliance.
• Experience supporting application security reviews, threat modeling, or penetration test remediation.
• Familiarity with Python scientific and engineering libraries.
• Experience managing JavaScript/TypeScript dependencies with npm, including upgrades in Angular applications.

Responsibilities

• Remediate vulnerabilities in third-party and open-source dependencies identified by SCA and SAST scans by opening and testing pull requests against product code.
• Run automated test suites and troubleshoot build and compatibility issues caused by dependency upgrades, collaborating with developers when deeper product expertise is needed.
• Reduce outstanding security exceptions by identifying upgrade paths, replacement components, or mitigations for vulnerable dependencies.
• Maintain and improve SAST, SCA, and DAST scanning and its integration into CI/CD pipelines, including scan templates, quality gates, and policies.
• Generate and maintain Software Bills of Materials (SBOMs) and support vulnerability tracking and handling for released products.
• Serve as the primary point of contact between Engineering and InfoSec, coordinating risk assessments, architecture and infrastructure reviews, and security exception requests by gathering development-team input and tracking reviews through approval.
• Partner with Application Security Engineers on DAST and penetration testing, helping developers interpret findings and track remediation.

Benefits

• A comprehensive set of outstanding benefits.