REMOTE--Senior DevSecOps Engineer - AI Security & Application Security Automatio

Senior DevSecOps Engineer - AI-Powered Application Security & Automation

Location: 100% Remote - United States
Schedule: Must be able to work Eastern Time (ET) business hours
Experience: 10+ Years
Focus: DevSecOps | Application Security | AI-Assisted Security | Vulnerability Management | CI/CD Security Automation

Position Overview
We are seeking a highly skilled, hands-on Senior DevSecOps Engineer to drive application security automation, vulnerability management, and secure software delivery across a complex enterprise technology environment.

This is not a traditional DevOps or infrastructure-focused position. The ideal candidate is an experienced DevSecOps and Application Security Engineer with deep expertise in SAST, SCA, software supply chain security, container and image security, and automated vulnerability remediation.

This individual will join a mature DevOps organization and serve as a technical expert in integrating security throughout the Software Development Life Cycle (SDLC). The role requires strong hands-on experience with GitHub, GitHub Advanced Security, secure CI/CD pipelines, scripting, and security automation, along with the ability to leverage emerging AI technologies to accelerate security analysis and vulnerability remediation.

The successful candidate will work directly with application development, DevOps, and security teams to implement scalable security controls, automate vulnerability detection and remediation, and strengthen enterprise application security without compromising development velocity.
This is an opportunity for an experienced engineer who combines deep application security knowledge, strong scripting and automation capabilities, and practical experience with AI-assisted security engineering.

Key Responsibilities
DevSecOps & Application Security Engineering

• Design, implement, and continuously improve enterprise DevSecOps practices, embedding automated security controls throughout the SDLC.
• Perform advanced application security analysis utilizing Static Application Security Testing (SAST), Software Composition Analysis (SCA), Dynamic Application Security Testing (DAST), and dependency scanning solutions.
• Identify, assess, prioritize, and remediate security vulnerabilities across enterprise applications, open-source libraries, and third-party dependencies.
• Partner directly with software development teams to investigate security findings, provide actionable remediation guidance, and implement secure coding practices.
• Develop automated vulnerability management workflows to streamline detection, prioritization, remediation, and validation.
• Establish and maintain security policies, quality gates, and automated compliance checks within software delivery pipelines.

Software Supply Chain & Container Security

• Strengthen software supply chain security by identifying risks associated with open-source dependencies, third-party packages, build artifacts, and application components.
• Implement and enhance container and image security scanning, identifying vulnerabilities, misconfigurations, and security risks within containerized application environments.
• Integrate dependency analysis, container scanning, and software supply chain security controls into CI/CD workflows.
• Collaborate with engineering teams to remediate vulnerable dependencies, insecure container images, and software supply chain exposures.
• Improve the security and integrity of software build, packaging, and deployment processes.

CI/CD Security Integration & Automation

• Design, develop, and maintain secure CI/CD pipelines using GitHub, GitHub Actions, GitHub Advanced Security, Jenkins, Azure DevOps, GCP Cloud Build, or similar platforms.
• Integrate SAST, SCA, container scanning, dependency analysis, and automated vulnerability detection directly into development workflows.
• Configure and optimize GitHub Advanced Security capabilities to support automated code scanning, dependency security, and vulnerability remediation.
• Develop scripts, reusable automation, and security integrations to reduce manual intervention and improve security efficiency.
• Implement automated security quality gates, policy enforcement, and remediation workflows that support rapid, secure software delivery.
• Enhance pipeline security, stability, and scalability across hybrid cloud and enterprise environments.

AI-Assisted Security & Intelligent Automation

• Leverage AI-powered development and security tools to accelerate vulnerability analysis, remediation recommendations, and secure code improvements.
• Utilize technologies such as Claude Code, GitHub Copilot, OpenAI Codex, Google Antigravity, or comparable AI-assisted engineering platforms.
• Apply LLMs, AI agents, Model Context Protocol (MCP) servers, and AI-enabled workflows to improve security analysis and developer productivity.
• Explore and implement AI-assisted approaches to vulnerability triage, security finding correlation, code remediation, and automated security reviews.
• Evaluate emerging AI-driven security capabilities and identify opportunities to strengthen existing DevSecOps processes.
• Validate AI-generated security recommendations and code fixes to ensure accuracy, reliability, and alignment with enterprise security standards.

Scripting, Engineering & Cross-Functional Collaboration

• Develop and maintain scripts and automation solutions that integrate security tooling with application development and CI/CD environments.
• Troubleshoot complex security integration issues across development pipelines, application environments, and security platforms.
• Partner with application developers, DevOps engineers, and cybersecurity teams to implement practical, scalable security solutions.
• Provide hands-on technical guidance for secure development, vulnerability remediation, and application security automation.
• Continuously evaluate and improve security tooling, processes, and engineering practices.

Required Qualifications

• 10+ years of experience in DevSecOps, Application Security, Secure Software Engineering, DevOps, or related technical disciplines.
• Strong hands-on DevSecOps engineering experience, with a primary focus on application security integration and automation rather than traditional infrastructure operations.
• Advanced expertise in SAST, SCA, vulnerability management, and application security testing, including the ability to analyze findings and drive code-level remediation.
• Demonstrated experience securing software supply chains, open-source dependencies, and containerized application environments.
• Hands-on experience with container and image security scanning, vulnerability identification, and remediation.
• Strong GitHub and GitHub Advanced Security experience, including integrating security capabilities into development workflows.
• Proven experience designing, implementing, and automating security controls within CI/CD pipelines.
• Strong scripting and automation background, with the ability to build custom security integrations, automate scanning workflows, and streamline vulnerability remediation.
• Practical experience leveraging AI-powered tools, LLMs, AI coding assistants, or intelligent automation for security analysis, vulnerability remediation, or software engineering productivity.
• Experience with enterprise application security tools such as SonarQube, Sonatype Nexus IQ, GitHub Advanced Security, HCL AppScan, Prisma, Qualys, or comparable platforms.
• Strong understanding of secure SDLC principles, application security best practices, vulnerability prioritization, and security governance.
• Proven ability to collaborate directly with application development teams to resolve vulnerabilities and improve overall security posture.

Preferred Qualifications

• Experience with AI agents, MCP servers, AI skills, and agentic automation frameworks.
• Hands-on experience with Claude Code, GitHub Copilot, OpenAI Codex, Google Antigravity, or comparable AI-assisted development platforms.
• Experience implementing automated vulnerability remediation or AI-assisted code security reviews.
• Experience with container security, image scanning, and software supply chain security governance at enterprise scale.
• Experience developing custom security automation using Python, PowerShell, Bash, or comparable scripting languages.
• Familiarity with software bills of materials (SBOMs), dependency governance, and secure build processes.
• Experience with hybrid cloud environments and enterprise-scale CI/CD platforms.
• Experience supporting application security initiatives within highly regulated industries.
• Ability to operate independently as a senior technical contributor while influencing engineering teams and security practices.

Technical Environment
DevSecOps & Application Security: SAST, SCA, DAST, Vulnerability Management, Dependency Analysis, Secure SDLC, Application Security Automation
Security Platforms: GitHub Advanced Security, SonarQube, Sonatype Nexus IQ, HCL AppScan, Prisma, Qualys
Software Supply Chain & Container Security: Container/Image Scanning, Open-Source Dependency Security, Software Supply Chain Security, Secure Builds, SBOMs
CI/CD & Development: GitHub, GitHub Actions, Jenkins, Azure DevOps, GCP Cloud Build, Automated Security Quality Gates
Scripting & Automation: Python, PowerShell, Bash, Security Tool Integrations, Automated Vulnerability Remediation
AI & Intelligent Security: LLMs, MCP Servers, AI Agents, AI Skills, Claude Code, GitHub Copilot, OpenAI Codex, Google Antigravity, AI-Assisted Security Analysis

The Ideal Candidate
The ideal candidate is a senior, hands-on DevSecOps and Application Security Engineer who has successfully implemented automated security solutions within enterprise development environments.

This individual brings advanced knowledge of SAST/SCA, vulnerability management, software supply chain security, and container security, with demonstrated expertise integrating these capabilities into GitHub-based CI/CD workflows.

Beyond traditional security tooling, they understand how to leverage scripting, automation, and emerging AI technologies to accelerate vulnerability remediation and improve developer productivity.

We are not seeking a traditional DevOps engineer focused primarily on infrastructure, cloud provisioning, Kubernetes administration, or deployment operations. We need a security-focused engineer who can build, automate, and continuously improve application security capabilities throughout the software delivery lifecycle.

#LI- Remote
#LI-MB1