Senior DevSecOps Engineer

Location: Seattle Hybrid, San Francisco Hybrid

Department: Software Engineering

Location Type: HYBRID

Employment Type: FULL_TIME

Who We're Looking For

What You’ll Do

• Own Infrastructure Compliance: Own Supio's SOC 2, HIPAA, and GDPR programs. Your job is to scale an audited program through automated evidence collection, remediations, and continuous control monitoring.
• Build and Run Infrastructure: Work as a full member of the DevOps team on our Cloud, Kubernetes, and Terraform platform, including CI/CD and observability. 
• Write Production Code: Build tooling and automation. This role has real software engineering scope.
• Own Access Control: Design and maintain identity and access management across cloud, source control, and internal tooling, including least privilege, access reviews, and auditability.
• Remediate Vulnerabilities: Identify and remediate CVEs across infrastructure and application code, working directly with engineering to close gaps before they become incidents.

You’re a Great Fit If You

• Experience: 5+ years in infrastructure, platform, or SRE engineering, with direct ownership of security and compliance work at a large organization with an established program (startup experience is a plus)
• Infrastructure: Strong hands-on experience with AWS, Kubernetes, and infrastructure as code (Terraform)
• Software Engineering: Able to write and ship production code, not only scripts
• Compliance: Hands-on experience taking systems through SOC 2, HIPAA, and GDPR audits from the engineering side
• Security Remediation: Proven track record remediating CVEs across both infrastructure and software
• Access Management: Experience designing and operating IAM and access controls in a cloud environment
• Education: Bachelor's degree in Computer Science or related field, or equivalent practical experience
• Problem Solving: Comfortable owning ambiguous, cross-cutting problems with no existing playbook, and building the process as you go
• Communication: Able to translate security and compliance findings into clear, actionable guidance for engineers who aren't security specialists

• Hands-on with automated security and compliance tooling (e.g., Vanta, SAST/SCA scanners, policy as code)
• Experience with AI governance frameworks
• Open-source contributions in security or infrastructure
• Background in a PII/PHI-heavy industry: medtech, healthtech, legal tech, insurance, or defense/security