Senior Security Engineer
New
I
Istari DigitalCybersecurity software
Anywhere - USFull-TimeSenior
Salary$135,000 - $220,000 a year. In addition to base salary, this role may be eligible for bonuses, equity.
Apply NowOpens the employer's application page
Job Details
- Experience
- 7+ years in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years owning security tooling in CI/CD pipelines
- Required Skills
- Python
Requirements
- Have 7+ years of experience in DevSecOps, application security, security operations and incident response, and general security engineering.
- Have at least 3 years owning security tooling in CI/CD pipelines.
- Bring deep hands-on experience configuring, tuning, and enforcing production-pipeline SAST, SCA, secrets detection, and container scanning tools.
- Have experience with risk-based gates, vulnerability thresholds, and exception processes.
- Have mapped security tooling and pipeline controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements and produced evidence for assessments or authorizations.
- Have evaluated, selected, or evolved security tooling and influenced engineering teams without direct authority.
- Have scripting or automation experience in Python, Bash, or similar.
- Hold Security+ or an equivalent DoD 8140 qualifying certification, or be able to obtain one within 2 months of hire.
- Familiarity with GitHub, Argo CD, JFrog, and Snyk is preferred.
- Preferred experience includes Government DevSecOps, ATO support, software supply-chain integrity, policy-as-code, AI/LLM security tools, and penetration testing.
- Familiarity with cloud and container environments such as Docker, Kubernetes, and AWS is preferred.
Responsibilities
- Own and evolve pipeline security tooling, including SAST, SCA, secrets detection, container scanning, and artifact signing.
- Assess tooling effectiveness and coverage, identify gaps, and lead improvements, consolidation, or replacement.
- Develop automated and manual penetration-testing capabilities with rapid feedback into engineering.
- Help mature security operations, incident response, and incident management capabilities.
- Translate NIST SP 800-53, NIST SP 800-171, and RMF requirements into enforceable pipeline gates, thresholds, and policies.
- Maintain risk-based pass/fail criteria and manage documented, traceable exceptions and manual review.
- Ensure artifact and commit signing, signature verification, branch protection, and repository rulesets protect security results from bypass or tampering.
- Automate creation and maintenance of SBOMs and VEX data, and produce assessor-ready evidence for authorizations, continuous monitoring, and audits.
- Move security checks earlier in development and partner with engineering teams to embed security into their workflows.
- Apply AI tooling to vulnerability triage, remediation, and security automation, and evaluate emerging capabilities.
View Full Description & ApplyYou'll be redirected to the employer's site
