Senior DevSecOps Engineer
for section headings. Use - for any list of duties/requirements/benefits, and
for prose.
We must not create sections like Pay/Schedule/Benefits unless posting actually states them. Benefits are stated: "What we offer" includes many benefits. So we can have a Benefits section.
Pay: Not specified (they say "Market competitive pay leveraging Carta data" but no specific numbers). That is vague; we should not create Pay section because it's not specific. The instruction: never create Pay/Schedule/Benefits sections unless the posting actually states them. Benefits are stated, so we can include Benefits. Pay is not specific numbers, so we should not create Pay section. Schedule not mentioned, so omit.
We need to include About Us section (maybe as About). The heading could be "About Us". That's fine.
We need to include Responsibilities section with subparts? The instruction: use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should have a top-level Responsibilities
. Under that we can have prose or lists. The responsibilities are described in paragraphs with bullet-like sentences. We can turn each bullet into
- . The responsibilities have four main areas: Security Engineering & Cloud Security, Application Security & DevSecOps, Security Modernization & Operational Excellence, Automation, AI & Engineering Enablement. Each area has multiple bullet points. We could either keep them as subheadings inside responsibilities (maybe using
but not allowed? Only h3 for section headings; we could still use but instruction only says use h3 for section headings; doesn't forbid other headings but better to stick to h3 for sections and use
or
for content. We could treat each area as a but maybe better to just list them as items with bold headings? But we need to preserve all substantive info. Could embed subheadings as inside - . That's acceptable.
Similarly for "What Success Looks Like" we could make a section
What Success Looks Like
with items.
"You Must Have" is requirements; we can make Requirements
(or Qualifications). Use for each requirement.
"About Us" as About Us
with .
"What we offer" as
Benefits
with .
We must exclude boilerplate: the scam warning, EEO, navigation, cookie, legal. Also the line about recruitment scams should be removed. Also the line about "We’ve recently noticed an increase in recruitment scams..." should be removed. Also the line about "If this sounds like you, we’d love for you to apply!" is application instruction; remove. Also the line about "Please note that all legitimate communication..." etc remove.
Also remove "Position Summary" maybe we keep as a section? The instruction: Use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Position Summary could be considered "About the role". We could use About the role
for the position summary paragraph. Or we could keep "Position Summary" as heading but they said e.g. About the role, Responsibilities... So better to rename to About the role. We'll output About the role
with the paragraph.
Now we need to preserve all substantive information: ensure we don't lose any details.
Let's extract content.
Position Summary paragraph:
"Virtuous is hiring a Senior DevSecOps Engineer to strengthen the security posture of our products, cloud infrastructure, and software delivery ecosystem. Reporting to the Director of IT & Security, you'll partner with Engineering, Cloud Engineering, DevOps, Architecture, and Security teams to build security into the way we design, develop, deploy, and operate software. You'll improve the security of our products and cloud environment by reducing security debt, modernizing security practices, and building secure-by-default solutions through automation and engineering. This role is embedded within a collaborative DevOps function and is ideal for someone who enjoys solving security problems through code, automation, and engineering rather than manual reviews or gatekeeping. We're looking for an engineer who is naturally curious, challenges conventional approaches, and safely leverages AI-assisted tooling and modern engineering practices to create scalable, high-impact solutions."
We'll put that in
.
Responsibilities: we have four sections.
Security Engineering & Cloud Security:
- Design, implement, and continuously improve secure Azure cloud architectures, networking, governance, and infrastructure to support scalable, secure-by-default engineering.
- Strengthen cloud security posture through infrastructure hardening, segmentation, secure connectivity patterns, RBAC/PIM, Azure Policy, and automated guardrails.
- Improve security visibility through logging, monitoring, SIEM integrations, detection engineering, and operational security tooling.
- Continuously assess and remediate cloud security risks, inherited infrastructure weaknesses, configuration drift, and operational security gaps.
- Embed security into infrastructure, platforms, and engineering workflows by collaborating with Cloud Engineering and DevOps teams to build secure-by-default solutions.
Application Security & DevSecOps:
- Identify and address security risks in application architecture, authentication, APIs, and data flows throughout the product lifecycle.
- Integrate security capabilities into CI/CD pipelines and engineering workflows, including SAST, DAST, dependency scanning, secrets management, software supply-chain security, and policy-based controls.
- Lead threat modeling, architecture reviews, and secure design discussions to identify security risks early in the software development lifecycle.
- Build developer-friendly security guardrails, reusable patterns, and automations that improve security without slowing delivery velocity.
- Drive timely remediation of security findings by enabling engineering teams with practical guidance, automation, and secure-by-default patterns.
Security Modernization & Operational Excellence:
- Lead efforts to reduce security backlog, cloud governance drift, stale permissions, infrastructure weaknesses, technical debt, and operational security risk.
- Balance risk reduction, engineering impact, and business priorities when determining what to remediate, standardize, automate, or defer.
- Collaborate with Security leadership to improve incident readiness, operational maturity, security visibility, and organizational resilience.
- Help modernize inherited systems while improving container security, Kubernetes security, and secure cloud-native engineering practices.
Automation, AI & Engineering Enablement:
- Leverage automation, APIs, scripting, AI-assisted tooling, and emerging technologies to improve security operations, engineering productivity, and organizational effectiveness.
- Continuously challenge traditional approaches by identifying opportunities to automate, simplify, or reimagine security and engineering workflows.
- Build self-service capabilities, reusable tooling, and scalable workflows that improve developer experience while strengthening security outcomes.
- Evaluate and adopt modern engineering practices, AI-assisted workflows, and emerging technologies that improve security outcomes, accelerate remediation, and increase engineering effectiveness.
- Act as a force multiplier across Security, Engineering, and Cloud Operations by creating systems that increase organizational leverage and effectiveness.
What Success Looks Like:
- Security controls are embedded into engineering workflows without creating unnecessary friction or slowing delivery velocity.
- Application and cloud security posture improve through strong engineering adoption, operational ownership, and scalable guardrails.
- Security backlog, infrastructure debt, and operational risk are consistently reduced through pragmatic remediation and automation.
- Cloud infrastructure is secure, resilient, observable, and governed through secure-by-default engineering practices.
- Automation, AI-assisted engineering, and intelligent workflows measurably improve team effectiveness, remediation velocity, and operational scalability.
- Engineering, Security, and Cloud teams operate as trusted partners with shared ownership of reliability, security, and business outcomes.
You Must Have (requirements):
- 5+ years of experience in Security Engineering, Application Security, Cloud Security, DevSecOps, or related security-focused engineering roles within cloud-native SaaS environments.
- Strong experience designing, securing, and modernizing Azure environments, including Azure networking, governance, RBAC/PIM, Azure Policy, and secure connectivity patterns.
- Experience improving application security through secure SDLC practices, threat modeling, CI/CD security controls, and engineering partnership.
- Hands-on experience implementing DevSecOps capabilities such as SAST, DAST, dependency scanning, secrets management, software supply-chain security, and policy automation.
- Experience with Kubernetes, Docker, container security, IaC, and modern cloud-native platforms.
- Hands-on experience with GitHub, GitHub Actions, GitHub Advanced Security (or equivalent), SIEM platforms, observability tooling, and cloud security technologies.
- Strong automation, scripting, troubleshooting, and cross-functional collaboration skills, with a focus on scalable solutions and operational improvement.
- Experience leveraging AI-assisted engineering tools (such as GitHub Copilot, Claude Code, or similar) and a demonstrated curiosity for applying automation and emerging technologies to improve security and engineering outcomes.
About Us:
Paragraphs:
"Virtuous software is powering the world’s leading nonprofits and inspiring a new generation of generosity. At Virtuous, we believe generosity has the power to transform the world - and so we are on a mission to create $10B in net new generosity by helping nonprofits better connect with and inspire their donors. Our talented team is hungry, humble, and committed to delivering best-in-class software solutions, customer success interactions, and sales experiences to the nonprofit community. Our values are more than just a poster on the wall. Instead, our mission and values are precisely why candidates choose Virtuous. Our core values are: Build Better: We build audacious ideas to accelerate philanthropy and dismantle the status quo. Display Radical Generosity: We are generous with our time & talent as we serve our team and the nonprofit community. Stay Humble & Enjoy the Journey: We take our work seriously, but we don't take ourselves too seriously. Virtuous should act as a career accelerator for everyone on our team. Team members should look back at their time at Virtuous as one of the most productive and stretching seasons in their professional lives. This means that working at Virtuous isn't for everybody. It is for the select few who are ready to do hard things and build something truly great. If this sounds like you, we’d love for you to apply!" We need to remove the application invitation sentence. So we cut off before "If this sounds like you, we’d love for you to apply!" Also remove the sentence about "If this sounds like you..." So we stop before that.
Thus About Us paragraph ends at "...build something truly great." We'll keep that.
What we offer (Benefits):
List:
- Market competitive pay leveraging Carta data
- Employee recognition through Bonusly (birthdays, anniversaries, achievements, etc.)
- 401(k) retirement plan with company matching- 50% match up to 6% of compensation after 90 days
- We value our employee’s work-life balance and encourage taking advantage of Unlimited PTO
- Supportive time off including paid volunteer days and company holidays
- Employer-contributed healthcare benefits, encompassing medical, dental, and vision coverage, with plans available for dependents and choices for Health Savings Accounts (HSA) and Flexible Spending Accounts (FSA).
- 12 weeks primary parent leave, 4 weeks secondary parent leave - full pay (adoption as well)
- We pride ourselves on Community and host exciting company outings and events.
We should not include the scam warning paragraph.
Now we need to output HTML fragment only, no or
for prose. We must not create sections like Pay/Schedule/Benefits unless posting actually states them. Benefits are stated: "What we offer" includes many benefits. So we can have a Benefits section. Pay: Not specified (they say "Market competitive pay leveraging Carta data" but no specific numbers). That is vague; we should not create Pay section because it's not specific. The instruction: never create Pay/Schedule/Benefits sections unless the posting actually states them. Benefits are stated, so we can include Benefits. Pay is not specific numbers, so we should not create Pay section. Schedule not mentioned, so omit. We need to include About Us section (maybe as About). The heading could be "About Us". That's fine. We need to include Responsibilities section with subparts? The instruction: use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should have a top-level Responsibilities
. Under that we can have prose or lists. The responsibilities are described in paragraphs with bullet-like sentences. We can turn each bullet into
but not allowed? Only h3 for section headings; we could still use but instruction only says use h3 for section headings; doesn't forbid other headings but better to stick to h3 for sections and use
or
- for content. We could treat each area as a
- . That's acceptable.
Similarly for "What Success Looks Like" we could make a section
What Success Looks Like
with- items.
"You Must Have" is requirements; we can make
Requirements
(or Qualifications). Use- for each requirement.
"About Us" as
About Us
with. "What we offer" as
Benefits
with- .
We must exclude boilerplate: the scam warning, EEO, navigation, cookie, legal. Also the line about recruitment scams should be removed. Also the line about "We’ve recently noticed an increase in recruitment scams..." should be removed. Also the line about "If this sounds like you, we’d love for you to apply!" is application instruction; remove. Also the line about "Please note that all legitimate communication..." etc remove.
Also remove "Position Summary" maybe we keep as a section? The instruction: Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Position Summary could be considered "About the role". We could use
About the role
for the position summary paragraph. Or we could keep "Position Summary" as heading but they said e.g. About the role, Responsibilities... So better to rename to About the role. We'll outputAbout the role
with the paragraph. Now we need to preserve all substantive information: ensure we don't lose any details. Let's extract content. Position Summary paragraph: "Virtuous is hiring a Senior DevSecOps Engineer to strengthen the security posture of our products, cloud infrastructure, and software delivery ecosystem. Reporting to the Director of IT & Security, you'll partner with Engineering, Cloud Engineering, DevOps, Architecture, and Security teams to build security into the way we design, develop, deploy, and operate software. You'll improve the security of our products and cloud environment by reducing security debt, modernizing security practices, and building secure-by-default solutions through automation and engineering. This role is embedded within a collaborative DevOps function and is ideal for someone who enjoys solving security problems through code, automation, and engineering rather than manual reviews or gatekeeping. We're looking for an engineer who is naturally curious, challenges conventional approaches, and safely leverages AI-assisted tooling and modern engineering practices to create scalable, high-impact solutions." We'll put that in. Responsibilities: we have four sections. Security Engineering & Cloud Security: - Design, implement, and continuously improve secure Azure cloud architectures, networking, governance, and infrastructure to support scalable, secure-by-default engineering. - Strengthen cloud security posture through infrastructure hardening, segmentation, secure connectivity patterns, RBAC/PIM, Azure Policy, and automated guardrails. - Improve security visibility through logging, monitoring, SIEM integrations, detection engineering, and operational security tooling. - Continuously assess and remediate cloud security risks, inherited infrastructure weaknesses, configuration drift, and operational security gaps. - Embed security into infrastructure, platforms, and engineering workflows by collaborating with Cloud Engineering and DevOps teams to build secure-by-default solutions. Application Security & DevSecOps: - Identify and address security risks in application architecture, authentication, APIs, and data flows throughout the product lifecycle. - Integrate security capabilities into CI/CD pipelines and engineering workflows, including SAST, DAST, dependency scanning, secrets management, software supply-chain security, and policy-based controls. - Lead threat modeling, architecture reviews, and secure design discussions to identify security risks early in the software development lifecycle. - Build developer-friendly security guardrails, reusable patterns, and automations that improve security without slowing delivery velocity. - Drive timely remediation of security findings by enabling engineering teams with practical guidance, automation, and secure-by-default patterns. Security Modernization & Operational Excellence: - Lead efforts to reduce security backlog, cloud governance drift, stale permissions, infrastructure weaknesses, technical debt, and operational security risk. - Balance risk reduction, engineering impact, and business priorities when determining what to remediate, standardize, automate, or defer. - Collaborate with Security leadership to improve incident readiness, operational maturity, security visibility, and organizational resilience. - Help modernize inherited systems while improving container security, Kubernetes security, and secure cloud-native engineering practices. Automation, AI & Engineering Enablement: - Leverage automation, APIs, scripting, AI-assisted tooling, and emerging technologies to improve security operations, engineering productivity, and organizational effectiveness. - Continuously challenge traditional approaches by identifying opportunities to automate, simplify, or reimagine security and engineering workflows. - Build self-service capabilities, reusable tooling, and scalable workflows that improve developer experience while strengthening security outcomes. - Evaluate and adopt modern engineering practices, AI-assisted workflows, and emerging technologies that improve security outcomes, accelerate remediation, and increase engineering effectiveness. - Act as a force multiplier across Security, Engineering, and Cloud Operations by creating systems that increase organizational leverage and effectiveness. What Success Looks Like: - Security controls are embedded into engineering workflows without creating unnecessary friction or slowing delivery velocity. - Application and cloud security posture improve through strong engineering adoption, operational ownership, and scalable guardrails. - Security backlog, infrastructure debt, and operational risk are consistently reduced through pragmatic remediation and automation. - Cloud infrastructure is secure, resilient, observable, and governed through secure-by-default engineering practices. - Automation, AI-assisted engineering, and intelligent workflows measurably improve team effectiveness, remediation velocity, and operational scalability. - Engineering, Security, and Cloud teams operate as trusted partners with shared ownership of reliability, security, and business outcomes. You Must Have (requirements): - 5+ years of experience in Security Engineering, Application Security, Cloud Security, DevSecOps, or related security-focused engineering roles within cloud-native SaaS environments. - Strong experience designing, securing, and modernizing Azure environments, including Azure networking, governance, RBAC/PIM, Azure Policy, and secure connectivity patterns. - Experience improving application security through secure SDLC practices, threat modeling, CI/CD security controls, and engineering partnership. - Hands-on experience implementing DevSecOps capabilities such as SAST, DAST, dependency scanning, secrets management, software supply-chain security, and policy automation. - Experience with Kubernetes, Docker, container security, IaC, and modern cloud-native platforms. - Hands-on experience with GitHub, GitHub Actions, GitHub Advanced Security (or equivalent), SIEM platforms, observability tooling, and cloud security technologies. - Strong automation, scripting, troubleshooting, and cross-functional collaboration skills, with a focus on scalable solutions and operational improvement. - Experience leveraging AI-assisted engineering tools (such as GitHub Copilot, Claude Code, or similar) and a demonstrated curiosity for applying automation and emerging technologies to improve security and engineering outcomes. About Us: Paragraphs: "Virtuous software is powering the world’s leading nonprofits and inspiring a new generation of generosity. At Virtuous, we believe generosity has the power to transform the world - and so we are on a mission to create $10B in net new generosity by helping nonprofits better connect with and inspire their donors. Our talented team is hungry, humble, and committed to delivering best-in-class software solutions, customer success interactions, and sales experiences to the nonprofit community. Our values are more than just a poster on the wall. Instead, our mission and values are precisely why candidates choose Virtuous. Our core values are: Build Better: We build audacious ideas to accelerate philanthropy and dismantle the status quo. Display Radical Generosity: We are generous with our time & talent as we serve our team and the nonprofit community. Stay Humble & Enjoy the Journey: We take our work seriously, but we don't take ourselves too seriously. Virtuous should act as a career accelerator for everyone on our team. Team members should look back at their time at Virtuous as one of the most productive and stretching seasons in their professional lives. This means that working at Virtuous isn't for everybody. It is for the select few who are ready to do hard things and build something truly great. If this sounds like you, we’d love for you to apply!" We need to remove the application invitation sentence. So we cut off before "If this sounds like you, we’d love for you to apply!" Also remove the sentence about "If this sounds like you..." So we stop before that. Thus About Us paragraph ends at "...build something truly great." We'll keep that. What we offer (Benefits): List: - Market competitive pay leveraging Carta data - Employee recognition through Bonusly (birthdays, anniversaries, achievements, etc.) - 401(k) retirement plan with company matching- 50% match up to 6% of compensation after 90 days - We value our employee’s work-life balance and encourage taking advantage of Unlimited PTO - Supportive time off including paid volunteer days and company holidays - Employer-contributed healthcare benefits, encompassing medical, dental, and vision coverage, with plans available for dependents and choices for Health Savings Accounts (HSA) and Flexible Spending Accounts (FSA). - 12 weeks primary parent leave, 4 weeks secondary parent leave - full pay (adoption as well) - We pride ourselves on Community and host exciting company outings and events. We should not include the scam warning paragraph. Now we need to output HTML fragment only, no or