Senior / Staff DevSecOps Engineer
Twenty · New York, NY · 1 mo ago
On-siteEngineering$159k–$263k/yrContract
We need to output HTML fragment with sections: About the role? Actually the posting includes "About The Company", "Role Summary", "What You'll Do", "Who You Are", "Must Have", "Nice to Have", "Tech Environment (You Might Work With)", "Security / Work Environment", "Benefits", "Compensation Range". We need to use for section headings (e.g., About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). However we must only include sections when posting has real specific content. We need to map content to these headings appropriately.
We should not repeat job title as heading. No Job ID etc.
We need to decide which headings to use: Likely "About the role" (maybe corresponds to Role Summary). "Responsibilities" (What You'll Do). "Requirements" (Must Have). "Qualifications" maybe combine Must Have? But we can have both Requirements and Qualifications? The instruction: use
for section headings (e.g., About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). However we must only include sections when posting has real specific content. We need to map content to these headings appropriately.
We should not repeat job title as heading. No Job ID etc.
We need to decide which headings to use: Likely "About the role" (maybe corresponds to Role Summary). "Responsibilities" (What You'll Do). "Requirements" (Must Have). "Qualifications" maybe combine Must Have? But we can have both Requirements and Qualifications? The instruction: use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can choose among these. We should not create sections with filler. We have content for About the role (Role Summary). Responsibilities (What You'll Do). Requirements (Must Have). Qualifications maybe similar to Requirements but we could treat Must Have as Requirements and Nice to Have as Qualifications? Or Skills could be Tech Environment? Benefits we have. Pay we have compensation range. Schedule not given (no schedule info). So we omit Schedule.
We need to preserve all substantive information, not invent or summarize away detail. Must not omit details. So we need to include all details from the posting under appropriate sections.
We need to remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we should drop the EEO paragraph, the "If this role sounds like you, apply..." line, the "Due to U.S. government contract..." maybe part of requirements? Actually that is a requirement about citizenship and clearance; it's substantive. We need to keep that. The equal opportunity employer paragraph is boilerplate, remove. The accommodation line also boilerplate? Might be considered EEO; remove.
Also remove "Mission | On Site | Full Time | U.S. Citizenship Required / No Active Clearance Required" maybe that's metadata; we can fold into a short p or drop. It's minor metadata; we can include in a short p under About the role? Probably better to drop as per instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. So we can drop that line. We need to keep "Security / Work Environment" content: "This role requires eligibility to obtain and maintain a U.S. Government security clearance. This role may involve work in a controlled environment." That's substantive; we could put under a section maybe "Security / Work Environment" but not in the list of allowed headings. However we could incorporate into Requirements or Qualifications? It's about clearance requirement. Could be part of Requirements. We'll include under Requirements as a bullet. We also have "Benefits" section with details. Good. We have "Compensation Range: $159K - $263K". That's Pay. We need to output only HTML fragment, no markdown fences. We'll structure:
About the role
Role Summary ...
Responsibilities
- Own runtime security and vulnerability management across cloud and container environments, including triage, prioritization, and remediation tracking. ... etc for each bullet from What You'll Do.
- Must Have items... plus maybe the security clearance line as a bullet. We could also have
Requirements
Qualifications
for Nice to Have? But Nice to Have is optional; we could still include as Qualifications. The instruction: prefer a few substantive sections over many thin ones. We could combine Must Have and Nice to Have under Requirements? But they are distinct. Could have Requirements (Must Have) and Qualifications (Nice to Have). That seems reasonable.Skills
maybe for Tech Environment? Could list tools. But we could also put under Requirements? Better to have Skills section for Tech Environment.Benefits
with ul.Pay
with p for compensation range. We must not create Schedule. Now ensure we preserve all substantive information: need to include all bullets from What You'll Do, Must Have, Nice to Have, Tech Environment, Benefits, Compensation, security clearance line, maybe also mention "Headquartered in Arlington, Virginia" etc from About The Company? Actually About The Company is not about the role; but we might include under About the role? The instruction: About the role heading for section headings (e.g. About the role...). The posting includes "About The Company". That's company description, not role. Should we include it? It's substantive information about the company. The instruction says preserve ALL substantive information; do NOT invent or summarize away detail. So we should include company description somewhere. Could be under About the role? Or maybe we create a section "About the company"? Not in allowed headings list but we could still use for any heading? The instruction says use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It gives examples but not exclusive? It says use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Likely they expect us to use those headings only. But we need to include company info; maybe we can fold it into About the role paragraph as a brief intro. That would preserve the info without adding a new heading. That seems acceptable: we can include company description in the About the role paragraph.
Thus About the role paragraph will contain both the company description and the role summary.
We must not repeat the job title as heading; we don't have job title given explicitly; but we can ignore.
Now we need to remove duplicated lines: there may be duplicate sentences like "This role requires eligibility to obtain and maintain a U.S. Government security clearance." appears twice? Actually appears in Security/Work Environment and also later in "Due to U.S. government contract and security requirements, this role is limited to U.S. citizens. Some positions may also require eligibility to obtain and maintain a U.S. Government security clearance. Any active clearance requirement will be listed in the role description." That's duplicate-ish. We need to preserve but not duplicate. We'll include the requirement once.
We need to include citizenship requirement: "U.S. Citizenship Required / No Active Clearance Required" from the metadata line. Also later: "Due to U.S. government contract and security requirements, this role is limited to U.S. citizens." So we need to include that U.S. citizenship required. Also mention that no active clearance required? Actually the metadata says "No Active Clearance Required". But later says some positions may also require eligibility to obtain and maintain a U.S. Government security clearance. The role summary didn't mention clearance; but the Security/Work Environment says requires eligibility to obtain and maintain a U.S. Government security clearance. There's some conflict. We need to preserve all substantive information; we should include both statements as they appear, but we can combine: mention that U.S. citizenship is required, and that the role requires eligibility to obtain and maintain a U.S. Government security clearance (or may involve). We'll include both.
Now let's extract bullets.
What You'll Do bullets (from text):
- Own runtime security and vulnerability management across cloud and container environments, including triage, prioritization, and remediation tracking.
- Design and enforce identity and access management (IAM) across AWS and internal systems — least-privilege by default.
- Own secrets and credentials management: policies, tooling, rotation, and developer workflows that make doing the right thing easy.
- Lead security incident response: detection, containment, root cause analysis, and durable remediation.
- Manage AWS Organization structure, account boundaries, SCPs, and guardrails.
- Harden and maintain CI/CD pipelines, embedding security scanning and policy enforcement into the software delivery lifecycle.
- Drive compliance efforts — own the evidence, controls, and remediation work to meet and maintain relevant frameworks.
- Build and maintain secure-by-default templates for repos, pipelines, and infrastructure modules.
- Reduce friction through automation: certificate issuance, secrets access, policy-as-code, and developer-facing tooling.
- Produce lightweight, practical security guidance that engineers actually use.
- Shape the direction of the DSO function as it scales, and contribute to hiring and team-building as we grow.
Now Must Have bullets:
- 8+ years in DevSecOps, platform security, or a closely related security engineering role.
- Deep hands-on experience with AWS — IAM, SCPs, Organizations, security services (GuardDuty, Security Hub, CloudTrail, etc.).
- Strong IaC experience with Terraform; you've used it to enforce security controls, not just provision infrastructure — and you've layered in policy-as-code tooling (e.g., OPA, Checkov, tfsec) or continuous compliance checks (e.g., AWS Config Rules) to catch drift and misconfigurations.
- Experience owning secrets management end-to-end in a production engineering environment.
- Proven track record designing and hardening CI/CD pipelines (we use GitHub Actions).
- Hands-on experience with container security, including image scanning and runtime controls.
- Experience leading or meaningfully contributing to a compliance program; CMMC Level 2 (or NIST SP 800-171) experience strongly preferred.
- You've run incident response — you've been on call, you've led the post-mortem, and you've shipped the fix.
- Strong communication skills and the ability to drive security adoption through enablement, not mandates.
Also include citizenship and clearance requirement: maybe as bullet: "U.S. citizenship required; eligibility to obtain and maintain a U.S. Government security clearance required." We'll add.
Nice to Have bullets:
- Experience growing a DSO or security engineering function — expanding scope, tooling, and team.
- Familiarity with observability tooling and using it for security signal (we use the LGTM stack).
- Background in configuration management tooling (Ansible or similar).
- Experience with developer-facing security platforms or internal tooling that improved engineering workflows.
- Interest in growing into a lead or manager role as the team scales.
Tech Environment (You Might Work With) bullets:
- Cloud: AWS (primary), Terraform for IaC, Ansible for configuration management
- Containers: Docker, Docker Compose
- CI/CD: GitHub Actions
- Vulnerability scanning: Trivy
- Observability: Grafana, Loki, Tempo, Mimir (LGTM stack)
- Alerting / on-call: PagerDuty
- Languages in use across engineering: Go, TypeScript/Node, React, Python
We could put these under Skills section.
Benefits bullets:
- Health. Medical, dental, and vision plan options. Life / AD&D, disability coverage options.
- Family. Paid parental leave for eligible full-time employees. 12 weeks for birthing parents, 4 for non-birthing parents, 6 weeks for adoptive, foster, or intended parents through surrogacy.
- Vacation. Paid holidays and flexible PTO. Take what you need.
- Retirement. 401(k) with pre-tax and Roth options. HSA/FSA options, dependent care FSA. Benefits vary by location, role, and eligibility. Full plan details provided during the interview and offer process.
We need to preserve each sentence; we can keep as list items.
Compensation Range: $159K - $263K.
Now we need to output HTML.
We'll start with About the role
then a
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Likely they expect us to use those headings only. But we need to include company info; maybe we can fold it into About the role paragraph as a brief intro. That would preserve the info without adding a new heading. That seems acceptable: we can include company description in the About the role paragraph.
Thus About the role paragraph will contain both the company description and the role summary.
We must not repeat the job title as heading; we don't have job title given explicitly; but we can ignore.
Now we need to remove duplicated lines: there may be duplicate sentences like "This role requires eligibility to obtain and maintain a U.S. Government security clearance." appears twice? Actually appears in Security/Work Environment and also later in "Due to U.S. government contract and security requirements, this role is limited to U.S. citizens. Some positions may also require eligibility to obtain and maintain a U.S. Government security clearance. Any active clearance requirement will be listed in the role description." That's duplicate-ish. We need to preserve but not duplicate. We'll include the requirement once.
We need to include citizenship requirement: "U.S. Citizenship Required / No Active Clearance Required" from the metadata line. Also later: "Due to U.S. government contract and security requirements, this role is limited to U.S. citizens." So we need to include that U.S. citizenship required. Also mention that no active clearance required? Actually the metadata says "No Active Clearance Required". But later says some positions may also require eligibility to obtain and maintain a U.S. Government security clearance. The role summary didn't mention clearance; but the Security/Work Environment says requires eligibility to obtain and maintain a U.S. Government security clearance. There's some conflict. We need to preserve all substantive information; we should include both statements as they appear, but we can combine: mention that U.S. citizenship is required, and that the role requires eligibility to obtain and maintain a U.S. Government security clearance (or may involve). We'll include both.
Now let's extract bullets.
What You'll Do bullets (from text):
- Own runtime security and vulnerability management across cloud and container environments, including triage, prioritization, and remediation tracking.
- Design and enforce identity and access management (IAM) across AWS and internal systems — least-privilege by default.
- Own secrets and credentials management: policies, tooling, rotation, and developer workflows that make doing the right thing easy.
- Lead security incident response: detection, containment, root cause analysis, and durable remediation.
- Manage AWS Organization structure, account boundaries, SCPs, and guardrails.
- Harden and maintain CI/CD pipelines, embedding security scanning and policy enforcement into the software delivery lifecycle.
- Drive compliance efforts — own the evidence, controls, and remediation work to meet and maintain relevant frameworks.
- Build and maintain secure-by-default templates for repos, pipelines, and infrastructure modules.
- Reduce friction through automation: certificate issuance, secrets access, policy-as-code, and developer-facing tooling.
- Produce lightweight, practical security guidance that engineers actually use.
- Shape the direction of the DSO function as it scales, and contribute to hiring and team-building as we grow.
Now Must Have bullets:
- 8+ years in DevSecOps, platform security, or a closely related security engineering role.
- Deep hands-on experience with AWS — IAM, SCPs, Organizations, security services (GuardDuty, Security Hub, CloudTrail, etc.).
- Strong IaC experience with Terraform; you've used it to enforce security controls, not just provision infrastructure — and you've layered in policy-as-code tooling (e.g., OPA, Checkov, tfsec) or continuous compliance checks (e.g., AWS Config Rules) to catch drift and misconfigurations.
- Experience owning secrets management end-to-end in a production engineering environment.
- Proven track record designing and hardening CI/CD pipelines (we use GitHub Actions).
- Hands-on experience with container security, including image scanning and runtime controls.
- Experience leading or meaningfully contributing to a compliance program; CMMC Level 2 (or NIST SP 800-171) experience strongly preferred.
- You've run incident response — you've been on call, you've led the post-mortem, and you've shipped the fix.
- Strong communication skills and the ability to drive security adoption through enablement, not mandates.
Also include citizenship and clearance requirement: maybe as bullet: "U.S. citizenship required; eligibility to obtain and maintain a U.S. Government security clearance required." We'll add.
Nice to Have bullets:
- Experience growing a DSO or security engineering function — expanding scope, tooling, and team.
- Familiarity with observability tooling and using it for security signal (we use the LGTM stack).
- Background in configuration management tooling (Ansible or similar).
- Experience with developer-facing security platforms or internal tooling that improved engineering workflows.
- Interest in growing into a lead or manager role as the team scales.
Tech Environment (You Might Work With) bullets:
- Cloud: AWS (primary), Terraform for IaC, Ansible for configuration management
- Containers: Docker, Docker Compose
- CI/CD: GitHub Actions
- Vulnerability scanning: Trivy
- Observability: Grafana, Loki, Tempo, Mimir (LGTM stack)
- Alerting / on-call: PagerDuty
- Languages in use across engineering: Go, TypeScript/Node, React, Python
We could put these under Skills section.
Benefits bullets:
- Health. Medical, dental, and vision plan options. Life / AD&D, disability coverage options.
- Family. Paid parental leave for eligible full-time employees. 12 weeks for birthing parents, 4 for non-birthing parents, 6 weeks for adoptive, foster, or intended parents through surrogacy.
- Vacation. Paid holidays and flexible PTO. Take what you need.
- Retirement. 401(k) with pre-tax and Roth options. HSA/FSA options, dependent care FSA. Benefits vary by location, role, and eligibility. Full plan details provided during the interview and offer process.
We need to preserve each sentence; we can keep as list items.
Compensation Range: $159K - $263K.
Now we need to output HTML.
We'll start with About the role
then a
Similar jobs
Senior/Staff DevSecOps Engineer
Engineering$159k–$263k/yrapply on jobs.ashbyhq.com
Senior / Staff DevSecOps Engineer
Engineering$138/hrapply on hackajob.com
Senior / Staff DevSecOps Engineer
Engineering$138/hrapply on jobs.ashbyhq.com
Senior Staff DevSecOps Engineer
Engineering$170k–$213k/yrapply on formenergy.com
Senior Staff Engineer - DevSecOps
Engineering$163k–$231k/yrapply on exelixis.wd1.myworkdayjobs.com
Senior DevSecOps Engineer
Engineering$137k–$185k/yr