DevOps Engineer – Security Assurance (SCA & SAST Focus)

Role Summary

We are seeking an experiencedDevOps Engineer – Security Assurancetosupport,build, andoperatesecure, scalable CI/CD platforms with deep integration ofApplication Security (DevSecOps)practices. This roleis responsible forembeddingStatic Application Security Testing (SAST)andSoftware Composition Analysis (SCA)tools into enterprise CI/CD workflows, ensuring vulnerabilities are detected early and remediated efficiently across cloud andon‑premenvironments.

The ideal candidate brings strong hands-on experience withcloud platforms (AWS), GitHub-based CI/CD, andLinux systems, coupled with provenexpertiseintegrating and scaling security tools within developer workflows.

Key Responsibilities

DevSecOps& Security Assurance

• Integrate,operate, and scaleSAST and SCA toolswithin CI/CD pipelines to enable automated vulnerability detection and compliance.

• Embedshift-left securitypractices across build, test, and deployment pipelines.

• Partner withSecurity, Compliance, and Engineering teamsto define and enforce application security standards.

• Automate policy enforcement, vulnerability thresholds, and security gating within CI pipelines.

• Analyze and triage security findings, reducing falsepositivesand improving developer adoption.

• Support audit, compliance, and security reviews by providing evidence from CI/CD security controls.

• Support on-prem server infrastructureofSecurity Assurance Tools and workflows.

• Integrate CI/CD pipelines withsource code management systemssuch asGitHub,Perforce(P4), and related tools.

• Troubleshoot complex pipeline, build, infrastructure, and security issues across hybrid cloud andon‑premenvironments.

• Create andmaintaincleardocumentation, runbooks, and architectural designs.

Required Qualifications

• Proven experience integratingSAST and SCA toolsinto CI/CD pipelines.

• Strong experience buildingcloud-based CI/CD pipelines, especially usingGitHub and GitHub Actions.

• Strong understanding ofSecurity Assurance tools likeKlocwork,Sonarqube,Linux systems(Debian-based preferred) and CI/CD workflows.

• Solid knowledge ofapplication security concepts, including: 

• Open-source dependency risk

• Secure coding practices

• Vulnerability management and remediation workflows

• Experience supportinglarge-scale CI orbuildplatformsused by multiple teams.

• Strong scripting and automation skills (Bash, Python, or similar).

• Excellent communication skills with the ability to work effectively acrossengineering, IT, and security teams.

Preferred / Nice-to-Have Skills

• Experience with commonSAST tools(e.g.,Klocwork,CodeQL, SonarQube).

• Experience withSCA tools(e.g., Black Duck,Snyk,WhiteSource/Mend, OSS Review Toolkit).

• Familiarity withhybrid cloud andon‑premarchitectures.

• Experience withartifact repositories, package management, or build caching strategies.

• Exposure tocontainer-based CI workloads(Docker, ephemeral runners).

• Understanding ofsecurity compliance frameworksand audit requirements.

• Experience improvingdeveloper security adoptionthrough automation and usability improvements.