Senior DevSecOps Engineer
Exiger · McLean, VA · 1 mo ago
Full-time
We need to output HTML fragment with sections: About the role? The posting includes "Who We Are" and "Position Summary". We need to use for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We should not repeat job title. We need to include sections only when posting has real specific content. We have content for Who We Are (company description) maybe as About the role? Actually "Who We Are" is company overview, could be placed under About the role? The instruction: use
for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We should not repeat job title. We need to include sections only when posting has real specific content. We have content for Who We Are (company description) maybe as About the role? Actually "Who We Are" is company overview, could be placed under About the role? The instruction: use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can create sections: About the role (maybe combine Who We Are and Position Summary). Responsibilities (list). Requirements (maybe Required Qualifications). Qualifications (maybe Preferred Qualifications). Skills? Could be derived but not explicit separate. Benefits, Pay, Schedule: not present, so omit.
We must preserve all substantive info, not invent. Remove boilerplate: EEO, hybrid work policy, awards etc? The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The awards paragraph maybe not boilerplate but could be considered marketing; but it's substantive? It says "Exiger is named a Leader...". Might be considered fluff but still part of posting. However we might keep it under About the role? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. So we should keep that info. The awards line is substantive. Also "Learn more at Exiger.com and follow Exiger on LinkedIn." That's like a call to action, maybe considered application instruction? It's not exactly instruction to apply, but could be considered promotional. Might be okay to keep? Safer to keep as part of About the role.
We need to output only HTML fragment, no /. Use headings, - for lists,
for prose.
We need to avoid repeating job title as heading. So no heading for Senior DevSecOps Engineer.
We need to include location? Could be part of About the role paragraph.
Let's structure:
About the role
Who We Are: Exiger is the AI partner for supply chain and procurement automation... (include all that). Then Position Summary paragraph.
Then Responsibilities
- each responsibility line.
Then
Required Qualifications
- each required qualification line.
Then
Preferred Qualifications
- each preferred qualification line.
We might also include Skills? Not needed.
We must not include Pay/Benefits/Schedule.
Check for duplicated lines: Ensure we don't repeat same bullet.
Let's extract content.
Who We Are paragraph:
"Who We Are: Exiger is the AI partner for supply chain and procurement automation. Its centralized 1EXIGER.AI platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management."
Position Summary paragraph:
"Senior DevSecOps Engineer Location: Richmond, VA preferred Position Summary The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle. As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction. A key focus of this role is security automation. The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting. The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and automation experience and is comfortable operating in regulated, cloud-based environments."
We need to keep location maybe in About the role.
Now Responsibilities list: copy each bullet from responsibilities section.
Let's list them:
- Design, build, and maintain automated security workflows across the software development lifecycle and broader security environment.
- Automate security processes such as vulnerability intake, ticket creation, assignment, enrichment, escalation, remediation tracking, exception handling, and reporting.
- Integrate security platforms with ticketing, CI/CD, cloud, and engineering systems using APIs, webhooks, scripts, and workflow automation.
- Embed automated application, dependency, secrets, infrastructure-as-code, container, and API security testing into CI/CD pipelines.
- Define and implement risk-based release gates, remediation timelines, exception processes, and finding ownership.
- Build reusable secure pipeline templates, hardened images, self-service security controls, and policy-as-code guardrails.
- Strengthen security across cloud infrastructure, containers, Kubernetes, identity, secrets management, networking, and deployment processes.
- Triage vulnerabilities and security findings based on severity, exploitability, exposure, asset criticality, and business impact.
- Automate vulnerability-management workflows to ensure findings are routed to the appropriate owners and tracked through remediation.
- Secure source code, third-party dependencies, build systems, artifacts, container images, and software supply-chain processes.
- Support application security reviews, threat modeling, security architecture reviews, monitoring, and incident-response activities.
- Translate regulatory and compliance requirements into scalable technical controls and automated audit evidence.
- Partner directly with Engineering teams to remediate security issues and promote secure development practices.
- Evaluate and integrate emerging security capabilities and technologies.
- Develop metrics and dashboards to measure security posture, remediation performance, and automation effectiveness.
- Lead cross-functional security initiatives and mentor engineers on DevSecOps and secure engineering practices.
Now Required Qualifications list:
- Eight or more years of experience in DevOps, platform engineering, cloud engineering, application security, product security, DevSecOps, or cybersecurity engineering.
- Significant hands-on experience designing, implementing, and operating DevSecOps capabilities in production environments.
- Demonstrated experience building security automation, including integrations between security tools, ticketing platforms, CI/CD systems, and engineering workflows.
- Strong software development or scripting experience using Python and/or Java, with additional experience in technologies such as PowerShell, Bash, JavaScript, or TypeScript.
- Ability to develop maintainable, reusable, and tested automation rather than relying solely on one-time scripts.
- Strong knowledge of REST APIs, webhooks, and systems integrations.
- Experience automating ticket creation, assignment, escalation, remediation tracking, or similar security operational workflows.
- Strong knowledge of CI/CD security, application security testing, vulnerability management, and software supply-chain security.
- Experience securing cloud platforms, containerized workloads, Kubernetes, infrastructure as code, Linux, networking, identity, encryption, logging, and secrets management.
- Knowledge of SAST, DAST, software composition analysis, secrets scanning, container scanning, infrastructure-as-code scanning, and related DevSecOps controls.
- Knowledge of threat modeling, OWASP guidance, web and API security, authentication, authorization, and secrets management.
- Experience prioritizing vulnerabilities and security findings based on technical and business risk.
- Strong communication skills with the ability to explain security risks, remediation options, and engineering tradeoffs to technical and non-technical stakeholders.
- Bachelor’s degree in computer science, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
Preferred Qualifications list:
- Hands-on experience with one or more of the following security platforms: CrowdStrike, Microsoft Sentinel, Aikido Security, Code42, Qualys.
- Experience integrating security platforms with Jira, ServiceNow, or similar ticketing and workflow systems.
- Experience with security orchestration, automation, and response (SOAR) platforms or equivalent automated security workflows.
- Experience with cloud-native security technologies such as Kubernetes, Docker, Terraform, Helm, and cloud IAM.
- Experience with policy-as-code technologies such as OPA, Rego, Kyverno, or similar tools.
- Familiarity with SBOMs, artifact signing, dependency security, provenance, and software supply-chain frameworks.
- Experience supporting regulated environments and frameworks such as FedRAMP, NIST, SOC 2, ISO 27001, or similar standards.
- Experience developing security metrics, dashboards, and automated compliance evidence.
Also there is a paragraph about awards etc: "Exiger is named a Leader in the Gartner® Magic Quadrant™ for Supplier Risk Management, twice selected as one of Fast Company's 'Brands That Matter,' and recipient of the Third Party Risk Association's Innovator Award, Exiger's technology has been recognized by leading analyst evaluations and 50+ awards. Learn more at Exiger.com and follow Exiger on LinkedIn."
We can include that in About the role paragraph after the Who We Are.
Also "At Exiger, our values define how we work and why we lead. We are mission-inspired, imagination-driven, trust-anchored, and compassion-focused—committed to building technology that makes the world safer, more transparent, and more resilient." Could be included.
Also "Exiger’s hybrid work policy is periodically reviewed and adjusted to align with evolving business needs." This is maybe boilerplate? It's about hybrid work policy; could be considered not essential but maybe keep? The instruction says remove boilerplate, legal, EEO etc. Hybrid work policy might be considered boilerplate but it's substantive about work arrangement. Might keep? Safer to keep? It's not EEO. I'd include it in About the role.
Now construct HTML.
We need to ensure no duplicate headings. Use
for each section.
Let's craft:
About the role
Who We Are: Exiger is the AI partner for supply chain and procurement automation. Its centralized 1EXIGER.AI platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management. Exiger is named a Leader in the Gartner® Magic Quadrant™ for Supplier Risk Management, twice selected as one of Fast Company's 'Brands That Matter,' and recipient of the Third Party Risk Association's Innovator Award, Exiger's technology has been recognized by leading analyst evaluations and 50+ awards. Learn more at Exiger.com and follow Exiger on LinkedIn. At Exiger, our values define how we work and why we lead. We are mission-inspired, imagination-driven, trust-anchored, and compassion-focused—committed to building technology that makes the world safer, more transparent, and more resilient. Exiger’s hybrid work policy is periodically reviewed and adjusted to align with evolving business needs. Position Summary: The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle. As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction. A key focus of this role is security automation. The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting. The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and
headings, - for lists,
for prose.
We need to avoid repeating job title as heading. So no heading for Senior DevSecOps Engineer.
We need to include location? Could be part of About the role paragraph.
Let's structure:
About the role
Who We Are: Exiger is the AI partner for supply chain and procurement automation... (include all that). Then Position Summary paragraph.
Then Responsibilities
- each responsibility line.
Then
Required Qualifications
- each required qualification line.
Then
Preferred Qualifications
- each preferred qualification line.
We might also include Skills? Not needed.
We must not include Pay/Benefits/Schedule.
Check for duplicated lines: Ensure we don't repeat same bullet.
Let's extract content.
Who We Are paragraph:
"Who We Are: Exiger is the AI partner for supply chain and procurement automation. Its centralized 1EXIGER.AI platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management."
Position Summary paragraph:
"Senior DevSecOps Engineer Location: Richmond, VA preferred Position Summary The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle. As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction. A key focus of this role is security automation. The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting. The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and automation experience and is comfortable operating in regulated, cloud-based environments."
We need to keep location maybe in About the role.
Now Responsibilities list: copy each bullet from responsibilities section.
Let's list them:
- Design, build, and maintain automated security workflows across the software development lifecycle and broader security environment.
- Automate security processes such as vulnerability intake, ticket creation, assignment, enrichment, escalation, remediation tracking, exception handling, and reporting.
- Integrate security platforms with ticketing, CI/CD, cloud, and engineering systems using APIs, webhooks, scripts, and workflow automation.
- Embed automated application, dependency, secrets, infrastructure-as-code, container, and API security testing into CI/CD pipelines.
- Define and implement risk-based release gates, remediation timelines, exception processes, and finding ownership.
- Build reusable secure pipeline templates, hardened images, self-service security controls, and policy-as-code guardrails.
- Strengthen security across cloud infrastructure, containers, Kubernetes, identity, secrets management, networking, and deployment processes.
- Triage vulnerabilities and security findings based on severity, exploitability, exposure, asset criticality, and business impact.
- Automate vulnerability-management workflows to ensure findings are routed to the appropriate owners and tracked through remediation.
- Secure source code, third-party dependencies, build systems, artifacts, container images, and software supply-chain processes.
- Support application security reviews, threat modeling, security architecture reviews, monitoring, and incident-response activities.
- Translate regulatory and compliance requirements into scalable technical controls and automated audit evidence.
- Partner directly with Engineering teams to remediate security issues and promote secure development practices.
- Evaluate and integrate emerging security capabilities and technologies.
- Develop metrics and dashboards to measure security posture, remediation performance, and automation effectiveness.
- Lead cross-functional security initiatives and mentor engineers on DevSecOps and secure engineering practices.
Now Required Qualifications list:
- Eight or more years of experience in DevOps, platform engineering, cloud engineering, application security, product security, DevSecOps, or cybersecurity engineering.
- Significant hands-on experience designing, implementing, and operating DevSecOps capabilities in production environments.
- Demonstrated experience building security automation, including integrations between security tools, ticketing platforms, CI/CD systems, and engineering workflows.
- Strong software development or scripting experience using Python and/or Java, with additional experience in technologies such as PowerShell, Bash, JavaScript, or TypeScript.
- Ability to develop maintainable, reusable, and tested automation rather than relying solely on one-time scripts.
- Strong knowledge of REST APIs, webhooks, and systems integrations.
- Experience automating ticket creation, assignment, escalation, remediation tracking, or similar security operational workflows.
- Strong knowledge of CI/CD security, application security testing, vulnerability management, and software supply-chain security.
- Experience securing cloud platforms, containerized workloads, Kubernetes, infrastructure as code, Linux, networking, identity, encryption, logging, and secrets management.
- Knowledge of SAST, DAST, software composition analysis, secrets scanning, container scanning, infrastructure-as-code scanning, and related DevSecOps controls.
- Knowledge of threat modeling, OWASP guidance, web and API security, authentication, authorization, and secrets management.
- Experience prioritizing vulnerabilities and security findings based on technical and business risk.
- Strong communication skills with the ability to explain security risks, remediation options, and engineering tradeoffs to technical and non-technical stakeholders.
- Bachelor’s degree in computer science, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
Preferred Qualifications list:
- Hands-on experience with one or more of the following security platforms: CrowdStrike, Microsoft Sentinel, Aikido Security, Code42, Qualys.
- Experience integrating security platforms with Jira, ServiceNow, or similar ticketing and workflow systems.
- Experience with security orchestration, automation, and response (SOAR) platforms or equivalent automated security workflows.
- Experience with cloud-native security technologies such as Kubernetes, Docker, Terraform, Helm, and cloud IAM.
- Experience with policy-as-code technologies such as OPA, Rego, Kyverno, or similar tools.
- Familiarity with SBOMs, artifact signing, dependency security, provenance, and software supply-chain frameworks.
- Experience supporting regulated environments and frameworks such as FedRAMP, NIST, SOC 2, ISO 27001, or similar standards.
- Experience developing security metrics, dashboards, and automated compliance evidence.
Also there is a paragraph about awards etc: "Exiger is named a Leader in the Gartner® Magic Quadrant™ for Supplier Risk Management, twice selected as one of Fast Company's 'Brands That Matter,' and recipient of the Third Party Risk Association's Innovator Award, Exiger's technology has been recognized by leading analyst evaluations and 50+ awards. Learn more at Exiger.com and follow Exiger on LinkedIn."
We can include that in About the role paragraph after the Who We Are.
Also "At Exiger, our values define how we work and why we lead. We are mission-inspired, imagination-driven, trust-anchored, and compassion-focused—committed to building technology that makes the world safer, more transparent, and more resilient." Could be included.
Also "Exiger’s hybrid work policy is periodically reviewed and adjusted to align with evolving business needs." This is maybe boilerplate? It's about hybrid work policy; could be considered not essential but maybe keep? The instruction says remove boilerplate, legal, EEO etc. Hybrid work policy might be considered boilerplate but it's substantive about work arrangement. Might keep? Safer to keep? It's not EEO. I'd include it in About the role.
Now construct HTML.
We need to ensure no duplicate headings. Use
for each section.
Let's craft:
About the role
Who We Are: Exiger is the AI partner for supply chain and procurement automation. Its centralized 1EXIGER.AI platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management. Exiger is named a Leader in the Gartner® Magic Quadrant™ for Supplier Risk Management, twice selected as one of Fast Company's 'Brands That Matter,' and recipient of the Third Party Risk Association's Innovator Award, Exiger's technology has been recognized by leading analyst evaluations and 50+ awards. Learn more at Exiger.com and follow Exiger on LinkedIn. At Exiger, our values define how we work and why we lead. We are mission-inspired, imagination-driven, trust-anchored, and compassion-focused—committed to building technology that makes the world safer, more transparent, and more resilient. Exiger’s hybrid work policy is periodically reviewed and adjusted to align with evolving business needs. Position Summary: The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle. As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction. A key focus of this role is security automation. The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting. The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and
for prose. We need to avoid repeating job title as heading. So no heading for Senior DevSecOps Engineer. We need to include location? Could be part of About the role paragraph. Let's structure:
About the role
Who We Are: Exiger is the AI partner for supply chain and procurement automation... (include all that). Then Position Summary paragraph.
ThenResponsibilities
- each responsibility line.
Then
Required Qualifications
- each required qualification line.
Then
Preferred Qualifications
- each preferred qualification line.
We might also include Skills? Not needed.
We must not include Pay/Benefits/Schedule.
Check for duplicated lines: Ensure we don't repeat same bullet.
Let's extract content.
Who We Are paragraph:
"Who We Are: Exiger is the AI partner for supply chain and procurement automation. Its centralized 1EXIGER.AI platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management."
Position Summary paragraph:
"Senior DevSecOps Engineer Location: Richmond, VA preferred Position Summary The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle. As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction. A key focus of this role is security automation. The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting. The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and automation experience and is comfortable operating in regulated, cloud-based environments."
We need to keep location maybe in About the role.
Now Responsibilities list: copy each bullet from responsibilities section.
Let's list them:
- Design, build, and maintain automated security workflows across the software development lifecycle and broader security environment.
- Automate security processes such as vulnerability intake, ticket creation, assignment, enrichment, escalation, remediation tracking, exception handling, and reporting.
- Integrate security platforms with ticketing, CI/CD, cloud, and engineering systems using APIs, webhooks, scripts, and workflow automation.
- Embed automated application, dependency, secrets, infrastructure-as-code, container, and API security testing into CI/CD pipelines.
- Define and implement risk-based release gates, remediation timelines, exception processes, and finding ownership.
- Build reusable secure pipeline templates, hardened images, self-service security controls, and policy-as-code guardrails.
- Strengthen security across cloud infrastructure, containers, Kubernetes, identity, secrets management, networking, and deployment processes.
- Triage vulnerabilities and security findings based on severity, exploitability, exposure, asset criticality, and business impact.
- Automate vulnerability-management workflows to ensure findings are routed to the appropriate owners and tracked through remediation.
- Secure source code, third-party dependencies, build systems, artifacts, container images, and software supply-chain processes.
- Support application security reviews, threat modeling, security architecture reviews, monitoring, and incident-response activities.
- Translate regulatory and compliance requirements into scalable technical controls and automated audit evidence.
- Partner directly with Engineering teams to remediate security issues and promote secure development practices.
- Evaluate and integrate emerging security capabilities and technologies.
- Develop metrics and dashboards to measure security posture, remediation performance, and automation effectiveness.
- Lead cross-functional security initiatives and mentor engineers on DevSecOps and secure engineering practices.
Now Required Qualifications list:
- Eight or more years of experience in DevOps, platform engineering, cloud engineering, application security, product security, DevSecOps, or cybersecurity engineering.
- Significant hands-on experience designing, implementing, and operating DevSecOps capabilities in production environments.
- Demonstrated experience building security automation, including integrations between security tools, ticketing platforms, CI/CD systems, and engineering workflows.
- Strong software development or scripting experience using Python and/or Java, with additional experience in technologies such as PowerShell, Bash, JavaScript, or TypeScript.
- Ability to develop maintainable, reusable, and tested automation rather than relying solely on one-time scripts.
- Strong knowledge of REST APIs, webhooks, and systems integrations.
- Experience automating ticket creation, assignment, escalation, remediation tracking, or similar security operational workflows.
- Strong knowledge of CI/CD security, application security testing, vulnerability management, and software supply-chain security.
- Experience securing cloud platforms, containerized workloads, Kubernetes, infrastructure as code, Linux, networking, identity, encryption, logging, and secrets management.
- Knowledge of SAST, DAST, software composition analysis, secrets scanning, container scanning, infrastructure-as-code scanning, and related DevSecOps controls.
- Knowledge of threat modeling, OWASP guidance, web and API security, authentication, authorization, and secrets management.
- Experience prioritizing vulnerabilities and security findings based on technical and business risk.
- Strong communication skills with the ability to explain security risks, remediation options, and engineering tradeoffs to technical and non-technical stakeholders.
- Bachelor’s degree in computer science, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
Preferred Qualifications list:
- Hands-on experience with one or more of the following security platforms: CrowdStrike, Microsoft Sentinel, Aikido Security, Code42, Qualys.
- Experience integrating security platforms with Jira, ServiceNow, or similar ticketing and workflow systems.
- Experience with security orchestration, automation, and response (SOAR) platforms or equivalent automated security workflows.
- Experience with cloud-native security technologies such as Kubernetes, Docker, Terraform, Helm, and cloud IAM.
- Experience with policy-as-code technologies such as OPA, Rego, Kyverno, or similar tools.
- Familiarity with SBOMs, artifact signing, dependency security, provenance, and software supply-chain frameworks.
- Experience supporting regulated environments and frameworks such as FedRAMP, NIST, SOC 2, ISO 27001, or similar standards.
- Experience developing security metrics, dashboards, and automated compliance evidence.
Also there is a paragraph about awards etc: "Exiger is named a Leader in the Gartner® Magic Quadrant™ for Supplier Risk Management, twice selected as one of Fast Company's 'Brands That Matter,' and recipient of the Third Party Risk Association's Innovator Award, Exiger's technology has been recognized by leading analyst evaluations and 50+ awards. Learn more at Exiger.com and follow Exiger on LinkedIn."
We can include that in About the role paragraph after the Who We Are.
Also "At Exiger, our values define how we work and why we lead. We are mission-inspired, imagination-driven, trust-anchored, and compassion-focused—committed to building technology that makes the world safer, more transparent, and more resilient." Could be included.
Also "Exiger’s hybrid work policy is periodically reviewed and adjusted to align with evolving business needs." This is maybe boilerplate? It's about hybrid work policy; could be considered not essential but maybe keep? The instruction says remove boilerplate, legal, EEO etc. Hybrid work policy might be considered boilerplate but it's substantive about work arrangement. Might keep? Safer to keep? It's not EEO. I'd include it in About the role.
Now construct HTML.
We need to ensure no duplicate headings. Use
for each section. Let's craft:
About the role
Who We Are: Exiger is the AI partner for supply chain and procurement automation. Its centralized 1EXIGER.AI platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management. Exiger is named a Leader in the Gartner® Magic Quadrant™ for Supplier Risk Management, twice selected as one of Fast Company's 'Brands That Matter,' and recipient of the Third Party Risk Association's Innovator Award, Exiger's technology has been recognized by leading analyst evaluations and 50+ awards. Learn more at Exiger.com and follow Exiger on LinkedIn. At Exiger, our values define how we work and why we lead. We are mission-inspired, imagination-driven, trust-anchored, and compassion-focused—committed to building technology that makes the world safer, more transparent, and more resilient. Exiger’s hybrid work policy is periodically reviewed and adjusted to align with evolving business needs. Position Summary: The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle. As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction. A key focus of this role is security automation. The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting. The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and
- each preferred qualification line.
We might also include Skills? Not needed.
We must not include Pay/Benefits/Schedule.
Check for duplicated lines: Ensure we don't repeat same bullet.
Let's extract content.
Who We Are paragraph:
"Who We Are: Exiger is the AI partner for supply chain and procurement automation. Its centralized 1EXIGER.AI platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management."
Position Summary paragraph:
"Senior DevSecOps Engineer Location: Richmond, VA preferred Position Summary The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle. As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction. A key focus of this role is security automation. The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting. The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and automation experience and is comfortable operating in regulated, cloud-based environments."
We need to keep location maybe in About the role.
Now Responsibilities list: copy each bullet from responsibilities section.
Let's list them:
- Design, build, and maintain automated security workflows across the software development lifecycle and broader security environment.
- Automate security processes such as vulnerability intake, ticket creation, assignment, enrichment, escalation, remediation tracking, exception handling, and reporting.
- Integrate security platforms with ticketing, CI/CD, cloud, and engineering systems using APIs, webhooks, scripts, and workflow automation.
- Embed automated application, dependency, secrets, infrastructure-as-code, container, and API security testing into CI/CD pipelines.
- Define and implement risk-based release gates, remediation timelines, exception processes, and finding ownership.
- Build reusable secure pipeline templates, hardened images, self-service security controls, and policy-as-code guardrails.
- Strengthen security across cloud infrastructure, containers, Kubernetes, identity, secrets management, networking, and deployment processes.
- Triage vulnerabilities and security findings based on severity, exploitability, exposure, asset criticality, and business impact.
- Automate vulnerability-management workflows to ensure findings are routed to the appropriate owners and tracked through remediation.
- Secure source code, third-party dependencies, build systems, artifacts, container images, and software supply-chain processes.
- Support application security reviews, threat modeling, security architecture reviews, monitoring, and incident-response activities.
- Translate regulatory and compliance requirements into scalable technical controls and automated audit evidence.
- Partner directly with Engineering teams to remediate security issues and promote secure development practices.
- Evaluate and integrate emerging security capabilities and technologies.
- Develop metrics and dashboards to measure security posture, remediation performance, and automation effectiveness.
- Lead cross-functional security initiatives and mentor engineers on DevSecOps and secure engineering practices.
Now Required Qualifications list:
- Eight or more years of experience in DevOps, platform engineering, cloud engineering, application security, product security, DevSecOps, or cybersecurity engineering.
- Significant hands-on experience designing, implementing, and operating DevSecOps capabilities in production environments.
- Demonstrated experience building security automation, including integrations between security tools, ticketing platforms, CI/CD systems, and engineering workflows.
- Strong software development or scripting experience using Python and/or Java, with additional experience in technologies such as PowerShell, Bash, JavaScript, or TypeScript.
- Ability to develop maintainable, reusable, and tested automation rather than relying solely on one-time scripts.
- Strong knowledge of REST APIs, webhooks, and systems integrations.
- Experience automating ticket creation, assignment, escalation, remediation tracking, or similar security operational workflows.
- Strong knowledge of CI/CD security, application security testing, vulnerability management, and software supply-chain security.
- Experience securing cloud platforms, containerized workloads, Kubernetes, infrastructure as code, Linux, networking, identity, encryption, logging, and secrets management.
- Knowledge of SAST, DAST, software composition analysis, secrets scanning, container scanning, infrastructure-as-code scanning, and related DevSecOps controls.
- Knowledge of threat modeling, OWASP guidance, web and API security, authentication, authorization, and secrets management.
- Experience prioritizing vulnerabilities and security findings based on technical and business risk.
- Strong communication skills with the ability to explain security risks, remediation options, and engineering tradeoffs to technical and non-technical stakeholders.
- Bachelor’s degree in computer science, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
Preferred Qualifications list:
- Hands-on experience with one or more of the following security platforms: CrowdStrike, Microsoft Sentinel, Aikido Security, Code42, Qualys.
- Experience integrating security platforms with Jira, ServiceNow, or similar ticketing and workflow systems.
- Experience with security orchestration, automation, and response (SOAR) platforms or equivalent automated security workflows.
- Experience with cloud-native security technologies such as Kubernetes, Docker, Terraform, Helm, and cloud IAM.
- Experience with policy-as-code technologies such as OPA, Rego, Kyverno, or similar tools.
- Familiarity with SBOMs, artifact signing, dependency security, provenance, and software supply-chain frameworks.
- Experience supporting regulated environments and frameworks such as FedRAMP, NIST, SOC 2, ISO 27001, or similar standards.
- Experience developing security metrics, dashboards, and automated compliance evidence.
Also there is a paragraph about awards etc: "Exiger is named a Leader in the Gartner® Magic Quadrant™ for Supplier Risk Management, twice selected as one of Fast Company's 'Brands That Matter,' and recipient of the Third Party Risk Association's Innovator Award, Exiger's technology has been recognized by leading analyst evaluations and 50+ awards. Learn more at Exiger.com and follow Exiger on LinkedIn."
We can include that in About the role paragraph after the Who We Are.
Also "At Exiger, our values define how we work and why we lead. We are mission-inspired, imagination-driven, trust-anchored, and compassion-focused—committed to building technology that makes the world safer, more transparent, and more resilient." Could be included.
Also "Exiger’s hybrid work policy is periodically reviewed and adjusted to align with evolving business needs." This is maybe boilerplate? It's about hybrid work policy; could be considered not essential but maybe keep? The instruction says remove boilerplate, legal, EEO etc. Hybrid work policy might be considered boilerplate but it's substantive about work arrangement. Might keep? Safer to keep? It's not EEO. I'd include it in About the role.
Now construct HTML.
We need to ensure no duplicate headings. Use
- each required qualification line.
Then