Senior DevSecOps Engineer

Position: Senior DevSecOps Engineer

Location: New York, NY

HYBRID: In-office 3 days per week

Duration: DIRECT HIRE – FULL TIME

Summary:

We are seeking a Senior DevSecOps Engineer to secure and automate the software delivery lifecycle for enterprise applications. This highly technical role requires strong experience with CI/CD infrastructure, automation, software development, cloud services, and application security.

You will work closely with developers, system engineers, cybersecurity engineers, and administrators to integrate scalable security controls into CI/CD pipelines. The role emphasizes developer-friendly security, high-quality tool output, false-positive reduction, and data-driven improvement.

Skills/Experience Needed:

• 7+ years of experience in information technology, information security administration, or security operations.

• Strong experience designing, building, and deploying complex engineering solutions.

• Expert-level Python programming skills; experience with additional languages is a plus.

• Hands-on experience with Docker and container orchestration platforms such as Kubernetes or Docker Swarm.

• Experience with DevSecOps tools and practices, including Terraform, Ansible, and CI/CD pipelines.

• Experience managing operations and security within AWS environments.

• Experience working in Agile environments using Scrum or Kanban.

• Ability to build support across technical and business teams to reduce attack surfaces while maintaining rapid delivery.

• Strong ability to communicate business risk and remediation requirements.

• Interest in agentic software development, including developing agentic skills to accelerate feature delivery and improve solution quality.

Responsibilities:

• Integrate and automate security controls within CI/CD pipelines.

• Develop services and tools that make security components easy for developers and engineers to use.

• Embed security principles into application architecture, infrastructure, code, and deployments.

• Advance shift-left security throughout the software development lifecycle.

• Test and validate application security controls across projects.

• Implement defensive practices and countermeasures across applications and infrastructure.

• Develop and maintain CI/CD security strategies and practices with technical leads.

• Manage security escalations through resolution.

• Analyze vulnerability data to understand weaknesses, risk, remediation options, and vendor-recommended workarounds.

• Communicate security risks and remediation requirements to technical and non-technical stakeholders.

• Research emerging tactics, techniques, and procedures and validate appropriate controls through CI/CD pipelines.

• Define and track security KPIs and metrics with business and technical teams.

• Share advanced practices that strengthen team capabilities and engineering quality.