DevSecOps Engineer

How you can make an impact

• Cloud Security Engineering: Design, implement, and maintain security controls across AWS environments, including IAM, VPC networking, encryption, secrets management, logging, account governance, and service configuration.
• Infrastructure as Code Security: Build and maintain secure Terraform modules and policies that enforce approved infrastructure patterns, least privilege, encryption, logging, tagging, network controls, and configuration standards.
• Secure CI/CD: Integrate security checks into CI/CD pipelines, including static analysis, dependency scanning, container scanning, secrets detection, infrastructure-as-code scanning, policy validation, and deployment gates.
• Kubernetes & Container Security: Harden EKS and Kubernetes environments through secure workload configuration, RBAC, admission controls, image security, runtime protections, network policies, secrets management, and cluster lifecycle best practices.
• Identity & Access Management: Develop and enforce least-privilege IAM patterns, role-based access controls, service identities, access review processes, and automated remediation for excessive or unused permissions.
• Vulnerability Management: Establish processes and automation for identifying, prioritizing, tracking, and remediating vulnerabilities across cloud infrastructure, containers, dependencies, operating systems, and application platforms.
• Security Automation: Build Python, Bash, or other automation to detect misconfigurations, validate controls, collect evidence, remediate security findings, and reduce repetitive security operations work.
• Cloud Detection & Monitoring: Implement and improve security monitoring, logging, alerting, and detection capabilities using AWS-native and third-party tooling, including CloudTrail, GuardDuty, Security Hub, CloudWatch, SIEM platforms, or similar technologies.
• Software Supply Chain Security: Improve software supply chain integrity through dependency controls, artifact signing, provenance, trusted build pipelines, image registries, SBOM practices, and secure release processes.
• Secrets & Key Management: Establish secure patterns for credentials, API keys, certificates, encryption keys, and secrets using services such as AWS KMS, Secrets Manager, Parameter Store, and related tooling.
• Security Incident Response: Support investigation and response for cloud and application security incidents, including containment, root-cause analysis, evidence collection, remediation, and post-incident corrective actions.
• Compliance & Control Automation: Translate security and compliance requirements into technical controls and automated evidence collection for frameworks such as SOC 2, ISO 27001, PCI DSS, or related standards.
• Security Architecture & Reviews: Perform security reviews for infrastructure changes, new services, deployment patterns, and application architectures; identify risk and recommend practical mitigations.
• Developer Enablement: Create reusable security patterns, documentation, guardrails, and tooling that make the secure implementation the easiest implementation for engineering teams.
• Continuous Improvement: Track security posture, recurring findings, control effectiveness, and operational trends to identify opportunities for better automation, prevention, and risk reduction.

Qualifications

• Experience: 3+ years of experience in DevSecOps, cloud security, DevOps, platform engineering, Site Reliability Engineering, or a related discipline, including significant responsibility for production cloud environments.
• AWS: Strong hands-on experience securing AWS services and architectures, including IAM, Organizations, VPC, EC2, S3, RDS, EKS, Lambda, Route 53, CloudTrail, KMS, GuardDuty, Security Hub, and related services.
• Terraform: Advanced proficiency with Terraform, including secure reusable modules, state management, policy enforcement, code review, drift management, and infrastructure lifecycle controls.
• Kubernetes: Strong understanding of Kubernetes and EKS security, including RBAC, pod security, admission controls, secrets, network policies, workload identity, image security, and cluster hardening.
• Security Engineering: Strong knowledge of cloud security principles, least privilege, defense in depth, encryption, network segmentation, secrets management, vulnerability management, threat modeling, and secure configuration.
• Programming & Automation: Proficiency in Python, Bash, Go, or another general-purpose language used to build security automation and operational tooling.
• CI/CD Security: Experience integrating security controls into delivery pipelines using platforms such as GitHub Actions, Jenkins, GitLab CI, Argo CD, or similar tooling.
• Security Tooling: Experience with tools for SAST, SCA, container scanning, IaC scanning, secrets detection, CSPM, SIEM, or cloud-native security monitoring.
• Linux & Containers: Strong Linux, Docker, and container fundamentals with the ability to troubleshoot security and configuration issues across hosts and workloads.
• Incident Response: Experience investigating security events or production incidents and contributing to containment, root-cause analysis, remediation, and follow-up actions.
• Compliance: Working knowledge of security control frameworks and audit expectations, including evidence collection, access reviews, logging, change controls, and technical control validation.
• Communication: Strong written and verbal communication skills, with the ability to explain security risk and recommended controls to both technical and non-technical stakeholders.

Preferred Qualifications

• AWS security-focused certifications such as AWS Certified Security - Specialty, AWS Certified Solutions Architect - Professional, or AWS Certified DevOps Engineer - Professional.
• Experience with policy-as-code tools such as Open Policy Agent (OPA), Conftest, Sentinel, Kyverno, or Gatekeeper.
• Experience with CSPM/CNAPP platforms, vulnerability scanners, SIEM platforms, or cloud security posture management tooling.
• Familiarity with supply chain security technologies and standards such as SBOMs, SLSA, artifact signing, provenance, and Sigstore/cosign.
• Experience with GitOps practices and tools such as Argo CD or Flux.
• Knowledge of security frameworks and standards such as CIS Benchmarks, NIST CSF, NIST 800-53, SOC 2, ISO 27001, or PCI DSS.

Benefits

• Comprehensive health and wellness benefits including medical, dental, and vision with 100% premium coverage for you
• Generous PTO and paid holidays
• MyShare Employee Ownership Program
• Work with industry leaders
• 401K, up to a 4% match (100% vested from day 1)

Location: Remote. Travel: Occasional travel may be needed (10% or less).