DevSecOps Lead

About the role

The Security team is seeking a DevSecOps Lead/Staff Engineer to build and scale our secure software development lifecycle and vulnerability management practices across the organization. This role will partner closely with Engineering, Platform, and Security to implement practical security standards and controls from code development through deployment and production.

You will help define how secure software gets built at YipitData by translating security requirements into clear policies, technical standards, and scalable processes. This is a hands-on, cross-functional role focused on improving developer workflows, strengthening CI/CD controls, and driving measurable risk reduction without slowing teams down.

This position reports to the Senior Director of Information Security and offers the opportunity to shape DevSecOps practices at a high-growth company.

This is a remote-friendly opportunity that can sit in NYC (where our headquarters is located), one of our office hubs (Austin, Miami, Los Angeles (CA), and Cupertino (CA)), or anywhere else in the US. However, depending upon where the remote work is performed, income could be subject to New York State tax withholding.

Responsibilities

• Own the roadmap for secure SDLC controls and partner with Engineering and Product to roll out standards that are practical, scalable, and auditable.
• Develop and maintain secure development policies, implementation standards, and guidance for engineering teams.
• Drive adoption of key controls across repositories and pipelines, including branch protection, pull request requirements, code review, secrets scanning, dependency scanning, infrastructure-as-code scanning, and container image scanning.
• Partner with Engineering and Product teams to integrate security guardrails into CI/CD workflows and developer tooling.
• Support vulnerability management operations, including intake, triage, remediation tracking, verification, and reporting.
• Build reference implementations, templates, and onboarding guidance to help teams adopt secure patterns consistently.
• Define and report on metrics such as control coverage, vulnerability aging, SLA performance, and remediation progress.
• Prepare audit-ready documentation and evidence that demonstrates controls are implemented and operating effectively.
• Evaluate and prioritize future enhancements such as SAST, DAST, SBOM generation, image signing, and broader software supply chain security improvements.

Requirements

• Have 6+ years of experience in DevSecOps, security engineering, application security, cloud security, or DevOps, including experience leading cross-functional programs or technical initiatives.
• Have experience building or improving Secure SDLC, CI/CD security, or vulnerability management programs in modern engineering environments.
• Understand Git-based workflows, CI/CD systems, cloud-native development, containers, and repository security controls.
• Have implemented or governed controls such as branch protection, code review, secrets scanning, SAST, SCA, infrastructure-as-code scanning, or container scanning.
• Can translate security requirements into clear standards and practical implementation plans that work for engineering teams.
• Are comfortable influencing stakeholders across Security, Engineering, and leadership.
• Have experience with GitHub Enterprise, GitHub Actions, Jenkins, or similar platforms, preferred.
• Have experience supporting SOC 2, audit readiness, or customer assurance efforts, preferred.
• Are familiar with software supply chain security concepts such as SBOMs, image signing, and artifact integrity, preferred.

Qualifications

• BS/MS in Computer Science, Information Security, or related field.
• Experience with CI/CD tools and practices.
• Strong understanding of security principles and practices.
• Ability to communicate complex technical concepts to non-technical stakeholders.
• Proven ability to manage multiple projects and priorities simultaneously.

Skills

• Experience with DevSecOps practices and tools.
• Knowledge of security frameworks and standards (e.g., NIST, CIS).
• Experience with vulnerability management tools and processes.
• Strong problem-solving and analytical skills.
• Excellent communication and collaboration skills.

Benefits

• Comprehensive benefits package including flexible work hours, parental leave, wellness budget, learning reimbursement, and more.
• Competitive salary range up to $250k + 10% target variable.
• Opportunity to shape DevSecOps practices at a high-growth company.
• Remote-friendly opportunity to work from NYC or one of our office hubs (Austin, Miami, Los Angeles (CA), and Cupertino (CA)) or anywhere else in the US.
• Equal employment opportunity policy.

Pay

The annual base compensation for this position is anticipated to be up to $250k + 10% target variable. The final offer may be determined by a number of factors, including, but not limited to, the applicant’s experience, knowledge, skills, abilities, as well as internal team benchmarks.

Schedule

This is a remote-friendly opportunity that can sit in NYC (where our headquarters is located), one of our office hubs (Austin, Miami, Los Angeles (CA), and Cupertino (CA)), or anywhere else in the US. However, depending upon where the remote work is performed, income could be subject to New York State tax withholding.