DevSecOps Security Engineer

Responsibilities: We are looking for a DevSecOps or application security hire. Location preference: TX, PA, NC, AZ. Provide technical security risk oversight of our Infosys partner including:

• Review and approval of security vulnerability acceptance requests
• Ensure adherence to security requirements and vulnerability remediation SLAsActive participation in recurring security and vulnerability oversight meetings
• Assist with daily DevSecOps security assurance operational and enforcement processes for our current suite of security automation tools.
• Provide support to IT teams for enhancing security and protection controls in relation to security automation, CI/CD, DevSecOps, and vulnerability remediation.
• Participate in DevSecOps security assurance projects and initiatives as assigned.

Qualifications: Experience working with widely used security automation technologies such as:

• Static application security testing (SAST)
• Software composition analysis (SCA)
• Open source software vulnerabilities
• Dynamic application security testing (DAST)
• Interactive application security testing (IAST)
• Container and image security scanningAPI security scanning
• Practical experience analyzing vulnerability data to understand and communicate risks, concerns and outcomes of decisions
• Experience with CI/CD pipeline tools and technologies such as Bamboo, Jenkins, GitHub, GitHub Actions, Artifactory, Nexus, Docker, Kubernetes, Ansible, or Terraform, and Atlassian Suite (Jira, Confluence, Bitbucket)
• Working knowledge of OWASP Top 10, SANS Top 25, NIST/NVD (National Vulnerability Database), CVSS (Common Vulnerability Scoring System), CVE (Common Vulnerabilities and Exposures), technical security vulnerability remediation/mitigation, and security risk oversight
• Strong, demonstrated analysis and problem-solving, communication, interpersonal skills
• Professional security certification in good standing such as ISC2 CISSP, ISC2 Certified Secure Software Lifecycle Professional (CSSLP), GIAC Security Essentials Certification (GSEC), or CompTIA Security+Recent software engineering experience is a plus
• Experience with scripting languages such as PowerShell, Python, Bash, or Postman is a plus
• Top 3 skills:
• Working knowledge of OWASP Top 10, SANS Top 25, NIST/NVD (National Vulnerability Database), CVSS (Common Vulnerability Scoring System), CVE (Common Vulnerabilities and Exposures), technical security vulnerability remediation/mitigation, and security risk oversight