Salary range is:
$106,277.25 - $150,000.00
This position is bonus and/or commission eligible.
The RoleAs a Senior DevSecOps Engineer, you will drive the integration of security best practices into software development and delivery. Working with development, operations, and cross-functional stakeholders, you will translate security requirements into practical controls within product workflows. You will help teams deliver secure, scalable, high-quality software, strengthen the security posture, support compliance with industry standards, and continuously improve security practices in alignment with business objectives.
Key Responsibilities:- Conduct security assessments and code reviews to identify vulnerabilities in applications and services.
- Implement security controls within CI/CD pipelines and development practices, partnering with development and operations teams to integrate and maintain those controls throughout software delivery.
- Develop and maintain security tools, frameworks, and processes that support secure coding. Automate selected security testing tasks within development workflows and make the resulting findings actionable for engineering teams.
- Perform dynamic scanning, penetration testing, and vulnerability assessments on web, mobile, and cloud-based applications. Work with engineering teams to prioritize findings, guide remediation, and validate fixes.
- Provide training and guidance to development and operations teams on secure coding and operations principles.
- Contribute to security policies, procedures, and controls, and translate applicable requirements into implemented controls within DevSecOps workflows.
- Configure and maintain application-facing network security controls in collaboration with application and infrastructure teams, aligning protections with application access requirements.
- Apply working knowledge of Azure and AWS infrastructure, services, and security capabilities to implement security controls for cloud-based applications and their supporting environments.
- Stay informed about emerging security threats, technologies, and best practices, applying relevant insights as needed.
- Document systems, processes, and procedures to foster knowledge sharing and maintain compliance.
AI-enabled DevSecOps responsibilities:
- Evaluate and integrate AI-assisted tools into DevSecOps workflows to support security automation, code review, vulnerability analysis, and remediation, retaining human oversight of security decisions.
- Review and validate AI-generated code, scripts, configurations, and remediation recommendations using code review, automated testing, and security scanning before adoption or deployment.
- Establish and document responsible-use practices for AI-assisted engineering, including appropriate handling of sensitive code and data, controlled tool access, and clear review and approval expectations.
Requirements:Education:Bachelor's degree in Information Security, Computer Science, Computer Engineering, or a related field, or equivalent practical experience in application security or DevSecOps.
Experience:- Minimum of 5+ years in a security-focused role, preferably involving application security/DevSecOps, with demonstrated ability to independently deliver security improvements in collaboration with development and operations teams.
- Demonstrated hands-on experience integrating security measures into CI/CD pipelines, including implementing and maintaining those integrations using DevOps tools and practices.
- Hands-on experience securing containerized environments using Docker and Kubernetes, with the ability to explain the security controls implemented and how they support secure deployment and operation.
- Proficiency in scripting languages such as PowerShell, Bash, or Python.
- Working knowledge of networking concepts (DNS, load balancers, VPNs, VPCs, and access control).
AI experience:
- Hands-on experience using AI-assisted development or security tools in engineering workflows, with the ability to explain the use case, personal contribution, validation approach, and results.
- Ability to critically assess AI-generated code, scripts, configurations, and security findings; identify incorrect assumptions or insecure recommendations; and validate outputs through testing and security analysis.
- Experience applying responsible-use practices for AI tools, including protecting sensitive code and data, limiting tool permissions, and maintaining human review of consequential changes.
Key Skills:- Knowledge of Secure Coding Practices:
- Able to understand and apply secure coding principles.
- Familiarity with common vulnerabilities (e.g., OWASP Top Ten).
- Collaboration and communication:
- Ability to work with development and operations teams across the development lifecycle, explain security requirements clearly, and agree on practical approaches for integrating security into delivery workflows.
- Practical Application Security Knowledge:
- Experience with application security tooling and automation supportive of DevSecOps efforts.
- Experience in Incident Response:
- Monitoring and responding to security incidents.
- Guiding remediation and mitigation strategies.
Interview Policy & Privacy Notice:A video interview is required for this position. Video interviews are transcribed. Transcriptions are retained and may be reviewed by CCC and our recruiters. Candidates are not permitted to use generative AI or automated assistance during the interviews unless explicitly allowed by the interview team for a specific exercise. Our Job Applicant Privacy Notice is available HERE.
