Senior DevSecOps Engineer

Requirements: 8+ years of experience in DevOps, DevSecOps, application security, security engineering, software engineering, platform engineering, or a related technical field. Strong hands-on experience with cloud services, preferably Azure, including application hosting, networking, storage, databases, identity, monitoring, access control, and security services.5+ years of experience designing, developing, securing, and maintaining CI/CD pipelines using tools such as Azure DevOps, GitHub Actions, YAML, GitLab CI, Jenkins, or similar platforms. Strong experience embedding security tools and controls into CI/CD pipelines, including SAST, DAST, SCA, secrets scanning, dependency scanning, container scanning, and other automated security validation tools Deep understanding of secure SDLC, DevSecOps principles, secure software development practices, and modern application security concepts. Strong understanding of OWASP Top 10, API security, authentication, authorization, input validation, session management, encryption, secure error handling, secrets handling, and software supply chain risk. Experience identifying, triaging, prioritizing, and driving remediation of application security vulnerabilities across new and existing applications. Experience with vulnerability management practices, including security scanning tools, risk assessment, remediation tracking, exception handling, and risk acceptance workflows. Experience with secrets management solutions such as Azure Key Vault, HashiCorp Vault, or equivalent technologies Experience with scripting and automation using PowerShell, Azure CLI, Bash, Python, Go, or similar technologies. Ability to read, understand, and reason about application code in one or more modern programming languages such as C#, Java, JavaScript, TypeScript, Python, Go, or similar. Familiarity with security and compliance frameworks such as OWASP, NIST, CIS, SOC 2, ISO 27001, PCI DSS, GDPR, or similar. Strong troubleshooting, analytical, and problem-solving skills Excellent communication skills with the ability to explain security concepts, risks, and remediation guidance to both technical and non-technical stakeholders. Ability to work independently, manage multiple priorities, and collaborate effectively with cross-functional teams. Proactive attitude toward continuous improvement, automation, secure engineering practices, and developer enablement.

Bonus Qualifications: Advanced cloud, DevOps, or security certifications such as AZ-400, Microsoft Certified: Azure Security Engineer, CISSP, CSSLP, CCSP, GWEB, GWAPT, or equivalent. Strong hands-on experience with Azure security services such as Azure Key Vault, Microsoft Defender for Cloud, Azure Policy, Microsoft Entra ID, Azure Monitor, Azure DevOps, and related Azure-native security capabilities. Experience with tools such as SonarQube, Veracode, Checkmarx, Snyk, Black Duck, Mend, GitHub Advanced Security, Semgrep, Burp Suite, OWASP ZAP, Wiz, Prisma Cloud, Aqua, or similar. Experience with threat modeling techniques and frameworks such as STRIDE, attack trees, abuse cases, or similar approaches. Strong understanding of microservices architecture and API security practices. Experience with OpenAPI/Swagger, OAuth2, OIDC, SAML, JWT, identity federation, and modern authentication and authorization patterns. Experience creating developer-facing security documentation, secure coding guidance, reusable pipeline templates, and security training materials. Experience building vulnerability dashboards, security KPIs, remediation workflows, and risk acceptance processes.

Travel Requirements: Occasional travel to our office may be requested up to once or twice a year