- Own and evolve pipeline security tooling, including SAST, SCA, secrets detection, container scanning, and artifact signing.
- Assess tooling effectiveness and coverage, identify gaps, and lead improvements, consolidation, or replacement.
- Develop automated and manual penetration-testing capabilities with rapid feedback into engineering.
- Help mature security operations, incident response, and incident management capabilities.
- Translate NIST SP 800-53, NIST SP 800-171, and RMF requirements into enforceable pipeline gates, thresholds, and policies.
- Maintain risk-based pass/fail criteria and manage documented, traceable exceptions and manual review.
- Ensure artifact and commit signing, signature verification, branch protection, and repository rulesets protect security results from bypass or tampering.
- Automate creation and maintenance of SBOMs and VEX data, and produce assessor-ready evidence for authorizations, continuous monitoring, and audits.
- Move security checks earlier in development and partner with engineering teams to embed security into their workflows.
- Apply AI tooling to vulnerability triage, remediation, and security automation, and evaluate emerging capabilities.
Python