DevSecOps Engineer

Responsibilities

• Help secure Virta's applications and platform, directly contributing to the trust our members and partners place in us.
• Collaborate across teams to ensure security is a seamless part of our development lifecycle.
• Improve Security Design: Help assess our current security controls within GCP and Kubernetes, identify areas for improvement, and contribute to the maturation of our security posture from good to great.
• Champion Secure Development: Partner closely with Engineering, Product, and Platform teams to integrate security best practices early and often ("shift-left") into the software development lifecycle.
• Build and Automate: Design, implement, and manage security tooling and automation to streamline vulnerability detection, remediation, and compliance verification. Replace manual processes with efficient, automated solutions.
• Refined Access Control: Evolve our identity and access management (IAM) strategy, ensuring least-privilege access and robust auditing capabilities across our systems.
• Strengthen Network Security: Continuously improve our network security architecture, policies, and controls within our cloud environment.
• Develop Clear Standards: Establish, document, and communicate practical security policies, standards, and guidelines for engineering teams.
• Support Security Initiatives: Drive vulnerability management efforts and enhance our incident response preparedness, ensuring we are ready to handle potential threats effectively.
• Cultivate Security Awareness: Act as a security evangelist, promoting security awareness and best practices throughout the engineering organization.

Qualifications

• Understanding and practical experience in securing cloud-native applications and infrastructure, particularly in Kubernetes environments.
• GCP experience is strongly preferred.
• Strong grasp of networking concepts, identity management (IAM), encryption, and common web application vulnerabilities (e.g., OWASP Top 10).
• Strong communication skills with the ability to clearly articulate complex security concepts to diverse audiences and influence technical direction across teams.
• Hands-on experience in application security, including secure coding practices, vulnerability management, and security testing (SAST, DAST, IAST); exposure to threat modeling is a plus.
• Proficiency in Infrastructure as Code (IaC) tools, specifically Terraform.
• Development experience with Go and/or Python.
• 5-7+ years of experience with 2+ at a high growth startup or similar environment.