Role Summary 

We are seeking an experienced DevOps Engineer – Security Assurance to support, build, and operate secure, scalable CI/CD platforms with deep integration of Application Security (DevSecOps) practices. This role is responsible for embedding Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tools into enterprise CI/CD workflows, ensuring vulnerabilities are detected early and remediated efficiently across cloud and on‑prem environments. 

The ideal candidate brings strong hands-on experience with cloud platforms (AWS),  GitHub-based CI/CD, and Linux systems, coupled with proven expertise integrating and scaling security tools within developer workflows. 

Key Responsibilities 

DevSecOps & Security Assurance 

• Integrate, operate, and scale SAST and SCA tools within CI/CD pipelines to enable automated vulnerability detection and compliance. 

• Embed shift-left security practices across build, test, and deployment pipelines. 

• Partner with Security, Compliance, and Engineering teams to define and enforce application security standards. 

• Automate policy enforcement, vulnerability thresholds, and security gating within CI pipelines. 

• Analyze and triage security findings, reducing false positives and improving developer adoption. 

• Support audit, compliance, and security reviews by providing evidence from CI/CD security controls. 

• Support on-prem server infrastructure of Security Assurance Tools and workflows. 

• Integrate CI/CD pipelines with source code management systems such as GitHub, Perforce (P4), and related tools. 

• Troubleshoot complex pipeline, build, infrastructure, and security issues across hybrid cloud and on‑prem environments. 

• Create and maintain clear documentation, runbooks, and architectural designs. 

Required Qualifications 

• Proven experience integrating SAST and SCA tools into CI/CD pipelines. 

• Strong experience building cloud-based CI/CD pipelines, especially using GitHub and GitHub Actions. 

• Strong understanding of Security Assurance tools like Klocwork, Sonarqube, Linux systems (Debian-based preferred) and CI/CD workflows. 

• Solid knowledge of application security concepts, including:  

• Open-source dependency risk 

• Secure coding practices 

• Vulnerability management and remediation workflows 

• Experience supporting large-scale CI or build platforms used by multiple teams. 

• Strong scripting and automation skills (Bash, Python, or similar). 

• Excellent communication skills with the ability to work effectively across engineering, IT, and security teams. 

Preferred / Nice-to-Have Skills 

• Experience with common SAST tools (e.g., Klocwork, CodeQL, SonarQube). 

• Experience with SCA tools (e.g., Black Duck, Snyk, WhiteSource/Mend, OSS Review Toolkit). 

• Familiarity with hybrid cloud and on‑prem architectures. 

• Experience with artifact repositories, package management, or build caching strategies. 

• Exposure to container-based CI workloads (Docker, ephemeral runners). 

• Understanding of security compliance frameworks and audit requirements. 

• Experience improving developer security adoption through automation and usability improvements.