Responsibilities

Design, build, and maintain CI/CD pipelines with automated security gates — static analysis, software composition analysis, secrets detection, container image scanning, and infrastructure-as-code policy checks — that fail fast and produce actionable findings.
Provision and manage cloud infrastructure as code across Azure and AWS environments and enforce configuration standards through policy-as-code rather than manual review.
Harden container and Kubernetes workloads, including base image lifecycle, admission control, runtime policy, network segmentation, and least-privilege workload identity.
Own secrets management and pipeline authentication — vaulted credentials, short-lived tokens, and federated identity — and drive the elimination of long-lived static keys.
Triage and prioritize vulnerability findings across source code, third-party dependencies, container images, and cloud posture; partner with engineering owners to drive remediation to closure against defined service levels.
Build and maintain software supply chain controls, including dependency and lockfile hygiene, artifact signing and provenance, and software bill of materials generation and distribution.
Instrument delivery and runtime environments for security observability by defining detections, dashboards, and alerting, and participate in response for pipeline and infrastructure incidents.
Automate cloud security posture assessment and remediation across accounts and subscriptions, covering identity, network, logging, and encryption baselines.
Support control mapping and audit evidence collection for applicable frameworks, favoring automated evidence generation over manual attestation.
Raise the security baseline of other engineers through reusable pipeline templates, documented golden paths, code review, and hands-on mentoring.
Design, build, and maintain CI/CD pipelines with automated security gates — static analysis, software composition analysis, secrets detection, container image scanning, and infrastructure-as-code policy checks — that fail fast and produce actionable findings.
Provision and manage cloud infrastructure as code across Azure and AWS environments and enforce configuration standards through policy-as-code rather than manual review.

Qualification

Must be a UBachelor's degree in Computer ScienceSolid grasp of core security conceptsClear written and verbal communicationKubernetes security depth

Required

Must be a U.S. Person as defined by the International Traffic in Arms Regulations (22 CFR §120.62) — a U.S. citizen, lawful permanent resident, or other protected individual.
5–10 years of professional experience in DevOps, platform, site reliability, security, or software engineering, including at least 3 years with direct responsibility for securing CI/CD pipelines or cloud infrastructure.
Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Engineering, or a related technical field, or equivalent demonstrated experience.
Production experience with at least one major cloud provider (Azure or AWS), including its identity and access management, networking, and logging services.
Hands-on experience building and maintaining pipelines in a modern CI/CD system such as GitHub Actions, GitLab CI, Azure Pipelines, or Jenkins.
Proficiency with infrastructure as code (Terraform, Bicep, CloudFormation, or Pulumi), with changes managed through version control and peer review.
Working knowledge of containers and orchestration (Docker and Kubernetes), including image hardening and cluster access control.
Automation and scripting ability in Python, Go, Bash, or PowerShell sufficient to build internal tooling and integrate vendor APIs, not solely to configure existing tools.
Practical experience integrating and operating application security tooling (Blackduck or Rapid7) — SAST, software composition analysis, secrets scanning, and image scanning — and triaging its output.
Solid grasp of core security concepts, including least privilege, network segmentation, key management, authentication and authorization protocols (OAuth 2.0, OIDC, SAML), and common vulnerability classes such as the OWASP Top 10.
Experience with Git-based team workflows, code review, and branch protection.
Clear written and verbal communication, with the ability to explain security risk and engineering tradeoffs to both technical and non-technical audiences.

Preferred

Experience in an export-controlled or otherwise regulated environment (ITAR/EAR, CMMC, NIST SP 800-171), or in aerospace, automotive, or advanced manufacturing.
Exposure to manufacturing or operational technology systems, including securing build, test, or production-floor systems that cannot tolerate unplanned downtime.
Software supply chain security experience with SBOM tooling (Syft, CycloneDX, SPDX), artifact signing (Sigstore/cosign), SLSA provenance, or platforms such as Black Duck, Snyk, or Dependency-Track.
Policy-as-code experience with Open Policy Agent/Rego, Kyverno, Conftest, Checkov, or cloud-native policy engines.
Kubernetes security depth, including admission controllers, service mesh mTLS, and runtime detection tooling such as Falco or Tetragon.
Secrets platform experience with HashiCorp Vault, Azure Key Vault, or AWS Secrets Manager, including dynamically issued credentials.
Detection engineering or SIEM experience (Microsoft Sentinel, Splunk, or Elastic), including log pipeline design and tuning.
Threat modeling experience and familiarity with the MITRE ATT&CK framework.

DevSecOps Engineer at Divergent · LumiJobs

DevSecOps Engineer

Responsibilities

Qualification

Required

Preferred

Benefits

Company

Divergent

More roles at Divergent