Senior DevSecOps Engineer

Join our team as a Senior DevSecOps Engineer, a foundational role where you'll shape how secure software is built. You'll work closely with our Developer Experience and SRE teams, as well as the Security organization. Your responsibilities will include owning security automation across our CI/CD pipelines, building security into our templates, hardening our software supply chain, and coordinating vulnerability exposure remediation. You'll also partner with the Security team on cloud security posture and support the rollout of penetration testing. This role offers a range of benefits, including paid volunteer work, parental leave, work from home opportunities, and extensive learning and development opportunities.

- So you build guardrails instead: pipelines that catch vulnerabilities before a human ever has to, golden paths with security baked in, and automation that turns "did we patch that?" from a meeting into a dashboard
- You believe the secure path should be the easy path. You've spent your career where security and engineering meet, and you've learned that scanners nobody reads and gates nobody can pass don't make software safer, they make engineers route around you
- You're comfortable in a CI/CD pipeline, an AWS account, and a Kubernetes cluster. You can read application code well enough to tell a real injection risk from scanner noise, and you'd rather fix the template that generated the bug than file 40 tickets about it
- As a Senior DevSecOps Engineer, how results are achieved is paramount for your success and ultimately result in our success as an organization. In this role, your foundational knowledge, skills, abilities and personal attributes are anchored in the following competencies:
- Good judgement - the exercise of critical thinking, analyzing and assessing problems and implications, identifying patterns, making connections of underlying issues, understanding risks and developing mitigation strategies, and taking ownership of the outcome
- Resourcefulness - taking a can-do approach, even in the face of obstacles and constraints by assessing what’s in front of you and effectively and efficiently optimizing what you have, whether it's working on something new or thinking about how to do something better
- Teamwork and communication - putting our collective best together through documentation, collaboration, relationship-building, listening, empathy, recruiting, and evangelism.Influence and leadership - fostering a community of knowledge-sharing, collaboration, mentorship, and forward-thinking
- Skills and knowledge - the capacity to actively learn and apply specific domain knowledge, know-how, and best practices to continually enhance and improve
- 5+ years of professional experience in software engineering, infrastructure, or security engineering
- Hands-on experience integrating security tooling into CI/CD pipelines (GitHub Actions strongly preferred): SAST, SCA, secrets detection, container scanning
- 3+ years focused on application security, security automation, or DevSecOps practice
- Demonstrated ability to reduce security friction for engineers, with examples of controls teams adopted willingly
- Proficiency in at least one programming language (Go, Python, or Ruby preferred); you build tooling, not just configure it
- Strong written communication; you document as you build
- Proficiency with AWS and its security services (IAM, GuardDuty, Security Hub, CloudTrail); you understand cloud identity well enough to design least-privilege access, not just audit it
- Experience with Kubernetes and infrastructure-as-code (Terraform preferred), including policy-as-code enforcement