DevSecOps Engineer
for each section heading. Use - for any list of duties/requirements/benefits. Use
for prose.
We must include a section only when posting has real specific content for it. So we need to decide which sections to include.
We have content for About the role (Role Summary). Responsibilities (What You’ll Do). Requirements/Qualifications (What We’re Looking For). Skills maybe from Bonus Points? Could be Skills. Benefits from Why ePayPolicy (Competitive salary, benefits, 401K, FTO, etc). Pay? Not specific salary numbers, just "Competitive salary" - that is vague but maybe considered content? The instruction: never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. "Competitive salary" is vague but still states something about pay. It's not a specific number but it's a statement. Might be acceptable? The instruction says avoid filler like "commensurate with experience". "Competitive salary" is similar but maybe still considered filler. Safer to omit Pay section if not specific. Schedule: they mention hybrid schedule: three days per week in office. That's specific enough. So we can include Schedule section.
Benefits: they list many benefits: Comprehensive benefits package with employer-paid basic life and disability premiums, 401K, Flexible Paid Time Off Policy (FTO), Company-sponsored quarterly “ePayItForward” initiatives, Supportive and inclusive culture, Fully-stocked kitchen, Lunch stipend when working onsite, Open communication, Huge opportunity for growth. That's specific enough. So Benefits section.
We also have Our Values section but not in allowed headings; we could maybe incorporate into About the role or Benefits? But we must not create extra headings not allowed. So we could omit Our Values or incorporate into Benefits? Probably better to omit as not allowed heading. Similarly Embracing AI, diversity etc could be omitted or maybe put under About the role? But we should preserve all substantive information. However we cannot create arbitrary headings; we could embed that prose under existing sections like About the role or Benefits. The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we need to include that info somewhere. We can add paragraphs under existing sections.
Thus we will have sections: About the role (h3), Responsibilities (h3), Requirements (h3) maybe Qualifications, Skills (h3) for Bonus Points, Benefits (h3), Schedule (h3). Possibly also Pay omitted.
We need to use
- for any list of duties/requirements/benefits. So for Responsibilities we have many bullet-like items; we can make a list. For Requirements we have bullet-like items; we can list. For Skills (Bonus Points) list. For Benefits list.
We need to ensure we don't repeat job title. No mention of Job ID.
Let's extract content.
About the role: Role Summary paragraph: "We are looking for a DevSecOps Engineer to join our Information Security team. In this role, you will bridge the gap between Security and Engineering, ensuring our SaaS payment platform remains secure by design without sacrificing development velocity or innovation speed. Reporting directly to the Head of Information Security, you will serve as a trusted technical partner to our engineering teams. You will own application security guardrails and tooling (SAST/SCA), lead targeted internal web application penetration testing for high-risk releases, manage edge security controls (Cloudflare WAF), and collaborate closely with our Tech Debt and Platform teams to systematically triage and remediate vulnerabilities."
That's prose.
Responsibilities: The "What You’ll Do (Key Responsibilities)" section includes several subheadings: Application Security, Tooling & Guardrails; Internal Web Application Penetration Testing & Risk Assessments; Edge & Infrastructure Security Alignment; Vulnerability Governance & Cross-Functional Partnership; Threat Monitoring & External Security. Each has bullet points.
We need to capture all substantive info. We'll create a
with - items summarizing each bullet.
Let's list them:
- Application Security, Tooling & Guardrails:
* SAST & SCA Governance: Maintain, tune, and optimize static analysis (Sonar) and software supply chain scanning tools (NPM/PyPI scanners) to eliminate noise, build developer trust, and enforce actionable quality gates.
* CI/CD Security Integration: Embed automated security checks seamlessly into GitHub Actions / GitLab CI pipelines, minimizing build latency while catching vulnerabilities prior to production release.
* Supply Chain Security: Proactively triage zero-day package dependencies and software supply chain risks, establishing clear, prioritized remediation paths for engineering teams.
- Internal Web Application Penetration Testing & Risk Assessments:
* Targeted Web App Pen Testing: Perform hands-on manual penetration testing and security assessments on high-risk feature releases, APIs, and web application workflows.
* Threat Modeling & Logic Review: Evaluate complex business logic, authentication flows, and authorization boundaries for flaws that automated scanners miss.
* Exploit Validation & Remediation Support: Produce clear, reproducible Proof-of-Concept (PoC) demonstrations to help developers understand vulnerability impact and guide effective fixes.
- Edge & Infrastructure Security Alignment:
* Secrets Management & IaC: Audit codebases for exposed credentials/secrets and assist in vault workflows. Support the rollout of Infrastructure-as-Code (IaC) scanning as the security program expands.
- Vulnerability Governance & Cross-Functional Partnership:
* Tech Debt Team Monthly Sync: Partner directly with the Tech Debt and Platform Engineering teams on a monthly cadence to review, prioritize, and burn down security vulnerabilities according to SLA targets.
* Developer-Centric Ticketing: Translate scanner outputs and pen test findings into actionable tickets complete with reproduction steps, context, and clear fix recommendations.
* Metrics & SLA Reporting: Track and report key performance metrics—such as Mean Time to Remediate (MTTR), scan coverage, and open high/critical risks—for joint Security and Engineering reviews.
- Threat Monitoring & External Security:
* Triage & Escalation: Act as the primary technical escalation point for dependency alerts, exposed credentials, and edge anomaly detections.
* Vulnerability Report Validation: Review, validate, and triage externally submitted security reports before passing verified findings to engineering.
We'll put each as
- .
Requirements (Qualifications): "What We’re Looking For (Qualifications)" includes:
- Experience: 3–5+ years of hands-on experience in Application Security, Security Engineering, or Penetration Testing within a modern SaaS or cloud environment.
- Offensive Security Skills: Demonstrated expertise in manual web application penetration testing, API security assessments, and using security tools.
- Defensive Tooling Knowledge: Hands-on experience configuring and tuning SAST, SCA, or DAST tools.
- Web & SaaS Fundamentals: Strong understanding of web security concepts (OWASP Top 10, modern authentication protocols like OAuth2/OIDC, JWT, CORS, CSP).
- Edge & Pipeline Automation: Experience with edge WAF management and integrating security checks into automated CI/CD pipelines.
- Collaborative Mindset: Strong communication skills with an ability to act as a partner—not a blocker—to software developers and engineering leadership.
We'll list each as
- .
Bonus Points (Nice-to-Haves) could be Skills section:
- Relevant industry certifications (e.g., OSCP, GWAPT, eWPT, CISSP, Azure Security Engineer Associate).
- Familiarity with Infrastructure-as-Code (Terraform) and container security (Docker, Kubernetes).
We'll list as
- under Skills.
Benefits: "Why ePayPolicy" includes:
- Competitive salary
- Comprehensive benefits package with employer-paid basic life and disability premiums
- 401K
- Flexible Paid Time Off Policy (FTO)
- Company-sponsored quarterly “ePayItForward” initiatives
- Supportive and inclusive company culture with a focus on work/life balance
- Fully-stocked kitchen
- Lunch stipend when working onsite
- Open communication (We won’t box you in! If you have a cool idea for a product improvement or a suggestion on how to improve the customer experience, let’s talk about it. We value everyone’s ideas and opinions.)
- Huge opportunity for growth
We'll list each as
- .
Schedule: "We operate on a hybrid schedule for in-office employees. Standard schedules are three days per week in the office, however, the cadence and days are determined by each team and manager."
We'll put as
.
Also we have other paragraphs: About EPayPolicy (the company description) maybe could go under About the role? But we already have About the role section for role summary. The company description could be placed under About the role as additional context? The instruction: About the role heading for section headings (e.g. About the role, Responsibilities...). So we can put company description under About the role as prose.
We also have "Our Values", "Embracing AI", "We value diversity". We need to preserve that info. Could incorporate into About the role or Benefits? Probably better to add a separate section? Not allowed headings. Could we add a
under About the role after the role summary? That would be okay. We'll include those paragraphs as part of About the role.
Thus About the role will contain:
- Company description paragraph(s) from "About EPayPolicy" and "Founded in 2014..." etc.
- Role Summary paragraph.
- Our Values paragraph(s).
- Embracing AI paragraph.
- Diversity paragraph.
We need to ensure we don't create extra headings.
Now produce HTML fragment.
We'll start with
About the role
then ... maybe multiple
paragraphs.
Then
Responsibilities
- ...
etc.
Then Requirements
...
Then Skills
...
Then Benefits
...
Then Schedule
...
Make sure no extra whitespace? It's fine.
Let's craft the content precisely.
About the role paragraphs:
Paragraph 1: Company description: "Every day, ePayPolicy helps over 10,000 insurance companies speed up incoming and outgoing payments. By helping them move from manual, outdated forms of payment collection to modern payment tools, we help their companies work faster and more efficiently. (Check out our almost 5-star customer reviews.) How do we do it? With powerful payment tools that just work. Our secure, online ACH and credit card payment page is the core product for many of our companies. But we also provide an integrated suite of helpful features for insurance companies of all sizes, including point-of-sale financing, payables network tools, and check reconciliation, all within a single dashboard. Our expert, live support team helps deliver exceptional care every day, with an industry-leading 97% customer retention rate. Our customers love us. We love them. Founded in 2014, our growing team is based in Austin, TX, and has clients in all 50 US states. We’ve grown over 300% in the last three years - with big
for prose. We must include a section only when posting has real specific content for it. So we need to decide which sections to include. We have content for About the role (Role Summary). Responsibilities (What You’ll Do). Requirements/Qualifications (What We’re Looking For). Skills maybe from Bonus Points? Could be Skills. Benefits from Why ePayPolicy (Competitive salary, benefits, 401K, FTO, etc). Pay? Not specific salary numbers, just "Competitive salary" - that is vague but maybe considered content? The instruction: never emit a heading followed by filler/placeholder text (e.g., "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. "Competitive salary" is vague but still states something about pay. It's not a specific number but it's a statement. Might be acceptable? The instruction says avoid filler like "commensurate with experience". "Competitive salary" is similar but maybe still considered filler. Safer to omit Pay section if not specific. Schedule: they mention hybrid schedule: three days per week in office. That's specific enough. So we can include Schedule section. Benefits: they list many benefits: Comprehensive benefits package with employer-paid basic life and disability premiums, 401K, Flexible Paid Time Off Policy (FTO), Company-sponsored quarterly “ePayItForward” initiatives, Supportive and inclusive culture, Fully-stocked kitchen, Lunch stipend when working onsite, Open communication, Huge opportunity for growth. That's specific enough. So Benefits section. We also have Our Values section but not in allowed headings; we could maybe incorporate into About the role or Benefits? But we must not create extra headings not allowed. So we could omit Our Values or incorporate into Benefits? Probably better to omit as not allowed heading. Similarly Embracing AI, diversity etc could be omitted or maybe put under About the role? But we should preserve all substantive information. However we cannot create arbitrary headings; we could embed that prose under existing sections like About the role or Benefits. The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we need to include that info somewhere. We can add paragraphs under existing sections. Thus we will have sections: About the role (h3), Responsibilities (h3), Requirements (h3) maybe Qualifications, Skills (h3) for Bonus Points, Benefits (h3), Schedule (h3). Possibly also Pay omitted. We need to use
- for any list of duties/requirements/benefits. So for Responsibilities we have many bullet-like items; we can make a list. For Requirements we have bullet-like items; we can list. For Skills (Bonus Points) list. For Benefits list.
We need to ensure we don't repeat job title. No mention of Job ID.
Let's extract content.
About the role: Role Summary paragraph: "We are looking for a DevSecOps Engineer to join our Information Security team. In this role, you will bridge the gap between Security and Engineering, ensuring our SaaS payment platform remains secure by design without sacrificing development velocity or innovation speed. Reporting directly to the Head of Information Security, you will serve as a trusted technical partner to our engineering teams. You will own application security guardrails and tooling (SAST/SCA), lead targeted internal web application penetration testing for high-risk releases, manage edge security controls (Cloudflare WAF), and collaborate closely with our Tech Debt and Platform teams to systematically triage and remediate vulnerabilities."
That's prose.
Responsibilities: The "What You’ll Do (Key Responsibilities)" section includes several subheadings: Application Security, Tooling & Guardrails; Internal Web Application Penetration Testing & Risk Assessments; Edge & Infrastructure Security Alignment; Vulnerability Governance & Cross-Functional Partnership; Threat Monitoring & External Security. Each has bullet points.
We need to capture all substantive info. We'll create a
- with
- items summarizing each bullet. Let's list them: - Application Security, Tooling & Guardrails: * SAST & SCA Governance: Maintain, tune, and optimize static analysis (Sonar) and software supply chain scanning tools (NPM/PyPI scanners) to eliminate noise, build developer trust, and enforce actionable quality gates. * CI/CD Security Integration: Embed automated security checks seamlessly into GitHub Actions / GitLab CI pipelines, minimizing build latency while catching vulnerabilities prior to production release. * Supply Chain Security: Proactively triage zero-day package dependencies and software supply chain risks, establishing clear, prioritized remediation paths for engineering teams. - Internal Web Application Penetration Testing & Risk Assessments: * Targeted Web App Pen Testing: Perform hands-on manual penetration testing and security assessments on high-risk feature releases, APIs, and web application workflows. * Threat Modeling & Logic Review: Evaluate complex business logic, authentication flows, and authorization boundaries for flaws that automated scanners miss. * Exploit Validation & Remediation Support: Produce clear, reproducible Proof-of-Concept (PoC) demonstrations to help developers understand vulnerability impact and guide effective fixes. - Edge & Infrastructure Security Alignment: * Secrets Management & IaC: Audit codebases for exposed credentials/secrets and assist in vault workflows. Support the rollout of Infrastructure-as-Code (IaC) scanning as the security program expands. - Vulnerability Governance & Cross-Functional Partnership: * Tech Debt Team Monthly Sync: Partner directly with the Tech Debt and Platform Engineering teams on a monthly cadence to review, prioritize, and burn down security vulnerabilities according to SLA targets. * Developer-Centric Ticketing: Translate scanner outputs and pen test findings into actionable tickets complete with reproduction steps, context, and clear fix recommendations. * Metrics & SLA Reporting: Track and report key performance metrics—such as Mean Time to Remediate (MTTR), scan coverage, and open high/critical risks—for joint Security and Engineering reviews. - Threat Monitoring & External Security: * Triage & Escalation: Act as the primary technical escalation point for dependency alerts, exposed credentials, and edge anomaly detections. * Vulnerability Report Validation: Review, validate, and triage externally submitted security reports before passing verified findings to engineering. We'll put each as
- . Requirements (Qualifications): "What We’re Looking For (Qualifications)" includes: - Experience: 3–5+ years of hands-on experience in Application Security, Security Engineering, or Penetration Testing within a modern SaaS or cloud environment. - Offensive Security Skills: Demonstrated expertise in manual web application penetration testing, API security assessments, and using security tools. - Defensive Tooling Knowledge: Hands-on experience configuring and tuning SAST, SCA, or DAST tools. - Web & SaaS Fundamentals: Strong understanding of web security concepts (OWASP Top 10, modern authentication protocols like OAuth2/OIDC, JWT, CORS, CSP). - Edge & Pipeline Automation: Experience with edge WAF management and integrating security checks into automated CI/CD pipelines. - Collaborative Mindset: Strong communication skills with an ability to act as a partner—not a blocker—to software developers and engineering leadership. We'll list each as
- . Bonus Points (Nice-to-Haves) could be Skills section: - Relevant industry certifications (e.g., OSCP, GWAPT, eWPT, CISSP, Azure Security Engineer Associate). - Familiarity with Infrastructure-as-Code (Terraform) and container security (Docker, Kubernetes). We'll list as
- under Skills. Benefits: "Why ePayPolicy" includes: - Competitive salary - Comprehensive benefits package with employer-paid basic life and disability premiums - 401K - Flexible Paid Time Off Policy (FTO) - Company-sponsored quarterly “ePayItForward” initiatives - Supportive and inclusive company culture with a focus on work/life balance - Fully-stocked kitchen - Lunch stipend when working onsite - Open communication (We won’t box you in! If you have a cool idea for a product improvement or a suggestion on how to improve the customer experience, let’s talk about it. We value everyone’s ideas and opinions.) - Huge opportunity for growth We'll list each as
- .
Schedule: "We operate on a hybrid schedule for in-office employees. Standard schedules are three days per week in the office, however, the cadence and days are determined by each team and manager."
We'll put as
. Also we have other paragraphs: About EPayPolicy (the company description) maybe could go under About the role? But we already have About the role section for role summary. The company description could be placed under About the role as additional context? The instruction: About the role heading for section headings (e.g. About the role, Responsibilities...). So we can put company description under About the role as prose. We also have "Our Values", "Embracing AI", "We value diversity". We need to preserve that info. Could incorporate into About the role or Benefits? Probably better to add a separate section? Not allowed headings. Could we add a
under About the role after the role summary? That would be okay. We'll include those paragraphs as part of About the role. Thus About the role will contain: - Company description paragraph(s) from "About EPayPolicy" and "Founded in 2014..." etc. - Role Summary paragraph. - Our Values paragraph(s). - Embracing AI paragraph. - Diversity paragraph. We need to ensure we don't create extra headings. Now produce HTML fragment. We'll start with
About the role
then... maybe multiple
paragraphs. Then
Responsibilities
- ... etc. Then
Requirements
- ...
Then
Skills
- ...
Then
Benefits
- ...
Then
Schedule
... Make sure no extra whitespace? It's fine. Let's craft the content precisely. About the role paragraphs: Paragraph 1: Company description: "Every day, ePayPolicy helps over 10,000 insurance companies speed up incoming and outgoing payments. By helping them move from manual, outdated forms of payment collection to modern payment tools, we help their companies work faster and more efficiently. (Check out our almost 5-star customer reviews.) How do we do it? With powerful payment tools that just work. Our secure, online ACH and credit card payment page is the core product for many of our companies. But we also provide an integrated suite of helpful features for insurance companies of all sizes, including point-of-sale financing, payables network tools, and check reconciliation, all within a single dashboard. Our expert, live support team helps deliver exceptional care every day, with an industry-leading 97% customer retention rate. Our customers love us. We love them. Founded in 2014, our growing team is based in Austin, TX, and has clients in all 50 US states. We’ve grown over 300% in the last three years - with big