application security engineer

malomatia

<div>
 
 Job Description
 
 
 
 We are seeking a skilled
 
 Application Security Specialist
 
 to join our Cybersecurity Practice. In this role, you will work closely with our application security, development, and QA teams to secure our clients&rsquo; applications across their entire lifecycle. You will conduct security testing, perform penetration tests, and assess vulnerabilities across web, mobile, API applications.
 
 
 Your responsibilities will span application penetration testing, automated security scanning (SAST, DAST, SCA), threat modelling, secure code review, and developer enablement. You will embed security best practices throughout the software development lifecycle and ensure that applications are designed and built with robust security controls.
 
 
 You will collaborate with development and DevOps teams to integrate security into CI/CD pipelines, triage and validate findings, and provide clear, actionable remediation guidance. The role requires hands-on technical expertise, strong analytical skills, and the ability to translate complex security findings into practical fixes that developers can implement.
 
 
 
 Responsibilities
 
 
 
 <ul>
 <li>
 Penetration Testing:Conduct penetration tests on web applications, mobile applications, APIs, and thick-client applications. Prepare detailed reports with clear risk ratings and actionable remediation recommendations.
 </li>
 <li>
 Security Scanning:Implement, tune, and manage automated security scanning tools (SAST, DAST, SCA) to continuously identify vulnerabilities in code, configurations, and third-party dependencies across all application types.
 </li>
 <li>
 Threat Modelling:Perform threat modelling to identify potential security risks and attack surfaces associated with applications early in the design process, and provide guidance on mitigating these risks.
 </li>
 <li>
 Secure Code Review:Review application source code for security vulnerabilities across multiple platforms and languages, and offer practical, developer-friendly recommendations for remediation.
 </li>
 <li>
 DevSecOps Integration:Integrate security testing and controls into CI/CD pipelines, enabling continuous and automated security validation as part of the development workflow.
 </li>
 <li>
 Training &amp; Awareness:Develop and deliver secure coding training sessions and workshops to raise application security awareness among development teams and other stakeholders.
 </li>
 <li>
 Tool Evaluation:Assess and recommend tools and technologies to enhance application security testing and monitoring capabilities across various platforms.
 </li>
 <li>
 Documentation:Create and maintain comprehensive documentation related to security assessments, vulnerability management, and application security standards and policies.
 
 
 </li>
 </ul>
 
 Qualifications
 
 
 
 <ul>
 <li>
 Education: Bachelor&rsquo;s / college degree in Computer Science, Information Security, or a related field.
 </li>
 <li>
 Experience: At least 3 years of experience in application security, secure software development, penetration testing, or a closely related field.
 </li>
 <li>
 Certifications: Relevant professional certifications are highly desirable. These may include, but are not limited to:
 </li>
 <ul>
 <li>
 OffSec certifications (e.g., OSWA, OSWE)
 </li>
 <li>
 eLearnSecurity (e.g., eWPT, eWPTX)
 </li>
 <li>
 GIAC / SANS (e.g., SEC542, GWAPT)
 </li>
 <li>
 BCSP or other application security certifications.
 </li>
 </ul>
 <li>
 Technical Skills: Proficiency with security testing tools such as Burp Suite (required), and familiarity with Snyk, HCL AppScan, Fority, and Postman (preferred). Strong understanding of secure coding practices and hands-on experience with at least one programming language. Familiarity with DevSecOps practices and CI/CD pipelines is preferred.
 </li>
 <li>
 Knowledge: In-depth knowledge of application security principles and practices, with strong familiarity with security frameworks and guidelines (e.g., OWASP Top 10, ASVS, MASVS, WSTG, MSTG). Understanding of common vulnerability classes, exploitation techniques, and remediation strategies. Knowledge of Qatar National Information Assurance (NIA) is a plus.
 </li>
 </ul>
</div>

Application Security

Everforth ECS

<div>Everforth ECS is seeking an Authentication Engineer to work in our Washington, DC office / remote. The role is contingent upon additional funding.

We are seeking a technically focused and detail-oriented Authentication Engineer to join our Identity Governance and Administration (IG&amp;A) team. This role is dedicated to the deployment, management, and continuous improvement of enterprise authentication systems, with a particular emphasis on Multi-Factor Authentication (MFA) and modern identity protocols.

You will work at the intersection of identity security and user experience, ensuring that authentication systems are correctly configured, performing reliably at scale, and aligned with the organization's security policies. This is a proactive role where you will identify gaps in authentication coverage, evaluate emerging authentication technologies, and work across teams to drive adoption and strengthen the organization's overall identity security posture.

If you bring deep technical knowledge of authentication systems, experience integrating them across complex enterprise environments, and the communication skills to support both technical teams and end users, we want to hear from you.

Salary Range: $120,000 - $130,000 
General Description of Benefits
Requirements:
MFA &amp; Authentication Systems
<ul>
<li>Hands-on experience deploying and managing enterprise MFA platforms (e.g., Microsoft Authenticator, Duo, RSA SecurID, or equivalent)</li>
<li>Strong understanding of modern identity and authentication protocols including SAML, OAuth 2.0, OpenID Connect, and RADIUS torchora.com</li>
<li>Experience integrating MFA solutions with Active Directory, Azure Active Directory, and Single Sign-On (SSO) platforms</li>
<li>Ability to troubleshoot authentication failures across complex, multi-system enterprise environments</li>
<li>Experience developing and enforcing MFA policies aligned with organizational security standards and zero-trust principles</li>
</ul>
Identity &amp; Access Management
<ul>
<li>Working knowledge of enterprise identity and access management (IAM) frameworks and platforms</li>
<li>Familiarity with Microsoft Active Directory, Azure Active Directory, and related Windows-based systems</li>
<li>Understanding of privileged access management (PAM) concepts and how authentication controls integrate within that model</li>
<li>Ability to support risk assessments and security continuous monitoring efforts related to identity and authentication</li>
</ul>
Collaboration &amp; Documentation
<ul>
<li>Ability to support large, cross-functional projects and communicate clearly with both technical and non-technical stakeholders</li>
<li>Experience creating and maintaining clear documentation for authentication configurations, procedures, and troubleshooting guides</li>
<li>Comfortable working with end users and support teams to resolve authentication issues and support MFA adoption at scale</li>
</ul>
A minimum of 3+ years of experience in identity and access management, with direct hands-on experience deploying and managing enterprise authentication and MFA solutions. Candidates with experience supporting large-scale MFA deployments or authentication migrations will be strongly preferred. 
 
Req Benefits:
<div>Benefits - Everforth ECS</div></div>

Authentication Engineer

CureMD

<div>Job Overview:
The Application Security Analyst at CureMD is a crucial member of our security team responsible for safeguarding our applications, data, and systems against potential security threats and vulnerabilities. This position offers a unique opportunity for professional growth and skill development within the field of application security. As an Application Security Analyst, you will work under the guidance of experienced security professionals, gaining hands-on experience in identifying and addressing security risks.
Job Responsibilities:<ul><li>
Security Assessments.</li><li>
Ability to exploit recognized vulnerabilities and discover new vulnerabilities.</li><li>
Analyzing and auditing the Source code of the Web/Mobile Application.</li><li>
Proficiency in scripting, Unix operating systems and windows.</li><li>
Proficient in Linux operating system configuration, utilities, and programming,</li><li>
Conducted manual external and internal penetration testing.</li><li>
Conduct Penetration testing/ Vulnerabilities Assessment for Cloud based web, desktop, and mobile apps.</li><li>
Perform static and dynamic code testing, manual code inspection, threat modeling, design reviews to identify vulnerabilities and security defects</li><li>
Keep up with the latest methods for ethical hacking and testing and are always evaluating new penetration testing tools</li><li>
Collaborate with other team members and stakeholders</li><li>
Assist in Security operational tasks.</li></ul>
Qualifications:<ul><li>
Bachelors in Information/Cyber Security, Information Technology, Computer Science or Software Engineering with majors in Information Security.</li><li>
Having 1 - 2 years of relevant experience</li><li>
Good understanding of security tools and technologies for performing Penetration Testing.</li><li>
Have Knowledge of different coding languages.</li><li>
Experience in testing business critical environments.</li><li>
CEH or any other related professional certification.</li><li>
Solid understanding of information security and applied cryptographic protocols.</li><li>
Good knowledge of security technologies for secure software development such as cryptography, authentication techniques and protocols etc.</li><li>
Having OWASP top ten vulnerabilities Knowledge.</li><li>
Good to understand tools and technologies for performing Penetration Testing.</li></ul>
Compensation and Benefits:
Financial:<ul><li>
Competitive salary and bi-annual bonus.</li><li>
Fast track and uncapped career growth for high performers.</li><li>
Company-sponsored vehicle financing (car and bike).</li><li>
Interest-free loans.</li><li>
Provident Fund: CureMD matches up to 8% of your base salary.</li></ul>
Health and Wellness:<ul><li>
In-house clinic with a team of certified male and female doctors with 24/7 telemedicine service.</li><li>
Hospital treatment monitoring by company doctors.</li><li>
Comprehensive health coverage for your immediate family (outpatient, inpatient, maternity and parents' inpatient).</li><li>
Exclusive health benefits and discounts at top class clinics and labs.</li></ul>
Supportive Workplace:<ul><li>
Pick-up and drop-off services for female employees.</li><li>
In-house daycare facility.</li><li>
In-house gym and recreational area to unwind.</li></ul>
Continued Learning:<ul><li>
Company-sponsored trainings, workshops, development programs and retreats.</li><li>
Paid specialized trainings/certifications.</li></ul>
The Difference You&rsquo;ll Make: 
At CureMD, every role, whether senior or junior, plays a pivotal part in transforming healthcare. By joining our innovative team, you&rsquo;ll contribute to groundbreaking technology that directly impacts patient care, enhances healthcare efficiency, and saves lives globally. Your skills and passion will drive meaningful change, helping us deliver solutions that support healthcare professionals in critical, real-time settings. Together, we&rsquo;re not just advancing technology &mdash; we&rsquo;re making a tangible difference in people&rsquo;s lives. Together, Let&rsquo;s save lives.</div>

Application Security Analyst

Decagon

<div>About Decagon
Decagon is the leading conversational AI platform empowering every brand to deliver concierge customer experiences.
Our technology enables industry-defining enterprises like Avis Budget Group, Block&rsquo;s Cash App and Square, Chime, Oura Health, and Hunter Douglas to deploy AI agents that power personalized, deeply satisfying interactions across voice, chat, email, SMS, and every other channel.
We&rsquo;re building a future where customer experiences are being redefined from support tickets and hold music to faster resolutions, richer conversations, and deeper relationships. We&rsquo;re proud to be backed by world-class investors who share that vision, including a16z, Accel, Bain Capital Ventures, Coatue, and Index Ventures, along with many others.
We&rsquo;re an in-office company, driven by a shared commitment to excellence and velocity. Our values &mdash; Just Get It Done, Invent What Customers Want, Winner&rsquo;s Mindset, and The Polymath Principle &mdash; shape how we work and grow as a team.
About the Team
The Security Engineering team at Decagon protects the platform that powers the most advanced conversational AI agents for enterprise customers across voice, chat, email and SMS. We build the security foundations that enable Decagon's AI agents to handle sensitive customer data with trust while defending against sophisticated, AI-enabled threats at massive scale.
Our mission is to provide magical support experiences &mdash; ensuring that AI agents and human agents can collaborate safely to help users resolve their issues while maintaining the highest standards of security and privacy.
About the Role
Lead the application security strategy and implementation for Decagon AI's conversational platform that serves enterprise customers at scale. You'll partner with engineering teams to build security directly into our AI-powered applications, ensuring protection against application-layer threats while maintaining the performance and reliability our customers expect. This role offers the opportunity to apply deep application security expertise to AI systems and shape security practices across our rapidly growing engineering organization.
In this role, you will<ul><li>
Design and implement application security controls across our AI agent platform, including secure coding practices, threat modeling, and vulnerability management.</li><li>
Collaborate closely with product engineering teams to integrate security throughout the software development lifecycle, from design, coding, PR, and deployment</li><li>
Establish application security testing programs including static analysis (SAST), dynamic analysis (DAST), and interactive testing (IAST) tailored for AI applications</li><li>
Lead security code reviews and architecture assessments for new features, with special focus on AI model integration points and customer data handling</li><li>
Build security tooling and automation to enable developers to identify and remediate vulnerabilities quickly while maintaining development velocity</li><li>
Respond to security incidents involving application vulnerabilities, coordinating remediation efforts and post-incident improvements</li></ul>
Your background looks something like this<ul><li>
Have 5+ years of hands-on application security engineering experience</li><li>
Expertise in secure software development practices, including threat modeling, secure code review, and vulnerability assessment</li><li>
Strong software engineering background with ability to review code across multiple languages and frameworks commonly used in AI/ML applications</li><li>
Experience implementing application security testing tools and integrating security into CI/CD pipelines</li><li>
Knowledge of OWASP Top 10, common application vulnerabilities, and modern application security frameworks</li><li>
Proven track record working with engineering teams to remediate security findings while balancing security and business requirements</li></ul>
Even better<ul><li>
Experience securing AI/ML applications, including prompt injection, model extraction, and adversarial input protections</li><li>
Background with large-scale, multi-tenant SaaS applications handling sensitive customer data</li><li>
Familiarity with Google Cloud application security services and container security best practices</li><li>
Knowledge of enterprise compliance requirements (SOC 2, ISO 27001, GDPR) from an application security perspective</li><li>
Experience with modern security tools like Semgrep, CodeQL, Cursor Bug Bot, XBOW, or similar</li></ul>
Compensation
$200K &ndash; $330K + Offers Equity
Benefits
We proudly offer the following benefits for our full-time employees:<ul><li>
Take what you need vacation policy (subject to local requirements; UK employees receive 25 days of statutory leave)</li><li>
Medical, Dental, and Vision benefits for you and your family</li><li>
Life Insurance and Disability Benefits</li><li>
Retirement Plan (e.g., 401K, pension)</li><li>
Parental Leave</li><li>
Fertility and family building benefits through Carrot</li><li>
Daily lunches and snacks in the office to keep you at your best</li></ul>
These benefits are described in more detail in Decagon&rsquo;s policies, may vary by location, and can change at any time according to applicable compensation and benefits plans.
Compensation Range: $200K - $330K</div>

Senior Security Engineer

Experian

<div><div>Role Overview</div> 
<ul><li>Lead and mentor a team of application security engineers and penetration testers.</li><li>
Guide team members&rsquo; daily project and operational activities</li><li>
Manage and mature the application security program through direct interactions.</li><li>
Actively seek to improve our application security and penetration testing operations.</li><li>
Identify improvement opportunities in all processes and activities involved.</li><li>
Participate in security and technology strategic planning to ensure identified risk governance is incorporated into the enterprise strategy.</li><li>
Appropriately assess risk and provide software security advice when business decisions are made.</li><li>
Set strategies, processes and oversee the management and operations of SAST, SCA, DAST, and penetration testing operations to provide coverage for the application portfolio.</li></ul><ul><li>
Function as a subject matter expert in application, network and cloud penetration testing, scanning platforms, exploits, tools, and techniques.</li><li>
Building and executing a security testing strategy and lead AI first transformation to improve effectiveness and efficiency of our services.</li><li>
Manage test resources to ensure maximum performance.</li><li>
Ensuring secure outcomes of application and configuration testing.</li><li>
Oversee vulnerability identification and measurement.</li><li>
Guide development teams through a review of their applications and risks against common application flaws like OWASP Top 10 and others Provide visibility to senior management along with context and prioritization of the issues.</li><li>
Operate as an advocate for Security in interactions with internal and external teams.</li><li>
Work with Risk &amp; Compliance teams on SOC 2, PCI-DSS, HIPAA, and other audits as needed Research and recommend policy and procedures as they relate to Application Security</li><li>
Lead projects to implement security technologies for the entire enterprise.</li><li>
Define security guardrails through automated tool policies, SLAs, custom rules, and support the developer community.</li><li>
Help the enterprise manage vulnerabilities across automated tooling and manual security assessments.</li><li>
Work with Champions to build relationships and ensure key activities are supported and deliverables are achieved in a timely manner.</li><li>
Support the AppSec technical team and ensure relationships with Business and team maximised and effective.</li></ul> 

 
<div>Experience and Skills</div> 
 <ul><li>Four-year college diploma or university degree in computer science or computer engineering, and/or 5 years equivalent work experience in application development.</li><li>
Preferred certifications are listed as follows OSCE3, OSCE, OSCP, OSWE, CCSAS, CCT, CRT, GXPN, CISSP or CSSLP or similar certification.</li><li>
3-5 years supervisory experience preferred.</li><li>
8-13 years direct experience in enterprise-level applications security.</li><li>
Previous experience leading teams of penetration testers strongly encouraged and highly desired.</li><li>
Experience with cloud-based application architectures</li></ul> 
 
<div>About Experian</div> 
Experian is a global data and technology company, powering opportunities for people and businesses around the world. We help to redefine lending practices, uncover and prevent fraud, simplify healthcare, create marketing solutions, and gain deeper insights into the automotive market, all using our unique combination of data, analytics and software. We also assist millions of people to realize their financial goals and help them save time and money.
We operate across a range of markets, from financial services to healthcare, automotive, agribusiness, insurance, and many more industry segments.
We invest in people and new advanced technologies to unlock the power of data. As a FTSE 100 Index company listed on the London Stock Exchange (EXPN), we have a team of 22,500 people across 32 countries. Our corporate headquarters are in Dublin, Ireland. Learn more at experianplc.com.
Our uniqueness is that we celebrate yours. Experian's culture and people are important differentiators. We take our people agenda very seriously and focus on what matters; DEI, work/life balance, development, authenticity, collaboration, wellness, reward &amp; recognition, volunteering... the list goes on. Experian's people first approach is award-winning; World's Best Workplaces&trade; 2024 (Fortune Top 25), Great Place To Work&trade; in 24 countries, and Glassdoor Best Places to Work 2024 to name a few. Check out Experian Life on social or our Careers Site to understand why.
Experian is proud to be an Equal Opportunity and Affirmative Action employer. Innovation is an important part of Experian's DNA and practices, and our diverse workforce drives our success. Everyone can succeed at Experian and bring their whole self to work, irrespective of their gender, ethnicity, religion, colour, sexuality, physical ability or age. If you have a disability or special need that requires accommodation, please let us know at the earliest opportunity.<div></div>
Experian Careers - Creating a better tomorrow together</div>

Application Security Manager

Bausch + Lomb

Date: Jul 10, 2026
 
Location: USA - Remote, US
 
#job-location.job-location-inline { display: inline; }
 
Company: Bausch+Lomb Companies Inc.
 
Bausch + Lomb (NYSE/TSX: BLCO) is a leading global eye health company dedicated to protecting and enhancing the gift of sight for millions of people around the world—from the moment of birth through every phase of life. Our mission is simple, yet powerful: helping you see better, to live better.
 
Our comprehensive portfolio of over 400 products is fully integrated and built to serve our customers across the full spectrum of their eye health needs throughout their lives. Our iconic brand is built on the deep trust and loyalty of our customers established over our 170-year history. We have a significant global research, development, manufacturing and commercial footprint of approximately 13,000 employees and a presence in approximately 100 countries, extending our reach to billions of potential customers across the globe. We have long been associated with many of the most significant advances in eye health, and we believe we are well positioned to continue leading the advancement of eye health in the future.
 
Why this Role Matters
 
Join the Surgical R&D organization in a role where you will help ensure the cybersecurity, safety, and reliability of innovative surgical products that support patient care. In this position, you will be responsible for embedding secure-by-design practices throughout the product lifecycle while partnering with engineering, quality, regulatory, and corporate security teams to deliver compliant and resilient solutions. This is a strong opportunity for someone who brings deep product security expertise, strong cross-functional collaboration skills, and a passion for advancing cybersecurity within a regulated medical device environment.
 
What You'll Do
 
Architect and implement a consistent cybersecurity strategy across surgical capital equipment product lines to establish a scalable and secure product ecosystem.
 Embed secure-by-design principles throughout the product lifecycle, providing guidance on secure architecture, threat modeling, design controls, cryptography, and secure communication protocols.
 Lead execution of cybersecurity requirements across development programs, ensuring alignment with regulatory expectations, corporate standards, and product quality objectives.
 Coordinate vulnerability management activities, including intake, triage, risk assessment, remediation tracking, and documentation of product security issues through closure.
 Serve as the Surgical R&D cybersecurity representative for vulnerability disclosure and incident response activities, supporting investigations, impact assessments, root cause analyses, and remediation efforts.
 Partner with engineering teams to implement security testing practices, including SAST, DAST, SCA, penetration testing, and automated security controls within development pipelines.
 Support supplier and third-party security initiatives by defining security requirements, managing software supply chain risks, and maintaining Software Bill of Materials (SBOM) processes.
 Collaborate with Quality, Regulatory Affairs, IT, and Corporate Product Security teams to ensure compliance with evolving cybersecurity regulations and industry standards while enabling efficient product delivery.
 
What You'll Bring
 
Required Education & Experience: 
Bachelor's degree in Engineering, Computer Science, Cybersecurity, or a related technical discipline.
 7+ years of experience in product security, application security, medical device cybersecurity, or software security within a regulated environment.
 Demonstrated experience supporting or leading cybersecurity activities for medical device or other regulated product development programs.
 Strong communication, collaboration, stakeholder management, and problem-solving skills.
 Ability to translate technical cybersecurity risks into clear, actionable guidance for engineering, quality, and regulatory stakeholders.
 
Specialized Technical, Regulatory & Industry Skills & Knowledge
 
Strong expertise in secure product design, threat modeling, vulnerability management, and secure software development practices.
 Working knowledge of connected device security, embedded systems, and software-enabled product architectures.
 Experience with security testing tools and methodologies, including SAST, DAST, SCA, and penetration testing.
 Understanding of software supply chain security practices, including SBOM development and third-party risk management.
 Experience working across cross-functional and global teams to drive cybersecurity outcomes and influence stakeholders without direct authority.
 Knowledge of secure development lifecycle (SDLC) frameworks, vulnerability disclosure processes, and product incident response activities.
 Familiarity with cybersecurity governance, risk assessment, and compliance processes within regulated industries.
 
Preferred
 
Advanced degree in Cybersecurity, Computer Science, Engineering, or a related field.
 Relevant industry certifications such as CISSP, CSSLP, OSCP, GWAPT, or equivalent.
 Experience in medical device, healthcare, or other regulated industries, and/or working within a quality-managed or GxP regulated environment.
 Working knowledge of medical device cybersecurity regulations and standards (e.g., FDA premarket/post market guidance, IEC 81001-5-1, AAMI TIR57, UL 2900, NIST frameworks).
 Experience developing cybersecurity documentation to support regulatory submissions and audits.
 
This position may be available in the following location(s): US - Remote
 
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.
 
For U.S. locations that require disclosure of compensation, the starting pay for this role is between $140,000 and $180,000. The estimated salary range reflects an anticipated range for this position. The actual base salary offered may depend on a variety of factors.
 
U.S. based employees may be eligible for short-term and/or long-term incentives. They may also be eligible to participate in medical, dental, vision insurance, disability and life insurance, a 401(k) plan and company match, a tuition reimbursement program (select degrees), company holidays, and well-being benefits, among others. U.S. based employees are also eligible to receive sick time, floating holidays and paid vacation.
 
Job Applicants should be aware of job offer scams perpetrated through the use of the Internet and social media platforms.
 
To learn more please read Bausch + Lomb's Job Offer Fraud Statement.
 
Our Benefit Programs: Employee Benefits: Bausch + Lomb
 
Applicants must be authorized to work for ANY employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.

Product Cybersecurity Architect

Occam Solutions

<div>Primary Responsibility 
The DevSecOps Engineer shall serve as the lead technical engineer responsible for designing, implementing, securing, automating, and sustaining the cloud infrastructure supporting the Office of Naval Research (ONR) Data &amp; Analytics environment. The DevSecOps Engineer shall lead the implementation and execution of the technical requirements identified in PWS Section 4.5 &ndash; Technical Infrastructure and Platform Support, including infrastructure automation, Continuous Integration/Continuous Deployment (CI/CD), cloud security, container orchestration, Infrastructure-as-Code (IaC), and operational sustainment of the FedRAMP High and DoD Impact Level 5 (IL5) cloud environment. 
The DevSecOps Engineer shall architect and maintain secure cloud infrastructure, automate deployment pipelines, support AI/ML platform integration, implement cloud-native security controls, monitor system health and security events, and ensure compliance with DoD cybersecurity requirements. This position will work closely with software developers, data engineers, cloud architects, cybersecurity personnel, and Government stakeholders to deliver resilient, scalable, and secure cloud services. 
Duties and Responsibilities

The DevSecOps Engineer shall:
<ul>
<li>Design, deploy, automate, and maintain secure cloud infrastructure supporting mission applications and analytics platforms.</li>
<li>Develop, implement, and manage automated CI/CD pipelines using tools such as Jenkins, GitLab CI/CD, or equivalent technologies.</li>
<li>Build and maintain Infrastructure-as-Code (IaC) solutions utilizing Terraform, Ansible, or similar automation frameworks.</li>
<li>Implement and manage containerized application environments using Docker, Kubernetes, or comparable orchestration platforms.</li>
<li>Configure, monitor, and optimize cloud-native security services including Web Application Firewalls (WAF), Intrusion Detection/Prevention Systems (IDS/IPS), endpoint protection, and Security Information and Event Management (SIEM) platforms.</li>
<li>Analyze security logs, audit events, vulnerability reports, and SIEM alerts to identify threats, recommend mitigation strategies, and support incident response activities.</li>
<li>Support continuous Authority to Operate (ATO) compliance through configuration management, security patching, vulnerability remediation, and security documentation.</li>
<li>Implement secure API management, identity and access management (IAM), secrets management, encryption, and least-privilege access controls.</li>
<li>Develop automated monitoring, logging, alerting, and operational dashboards to improve system reliability and performance.</li>
<li>Support deployment and operationalization of AI/ML platforms and services, including cloud-native machine learning environments.</li>
<li>Collaborate with software developers, data engineers, and cloud architects to integrate security throughout the software development lifecycle (SDLC).</li>
<li>Ensure cloud infrastructure complies with DoD cybersecurity policies, FedRAMP High requirements, DoD IL5 controls, and applicable security frameworks.</li>
<li>Support system scalability, resilience, disaster recovery, and operational continuity.</li>
<li>Document system architectures, deployment procedures, security configurations, and operational processes.</li></ul> 


Minimum Qualifications

The DevSecOps Engineer shall meet the requirements for the &quot;DevSecOps Engineer &ndash; Intermediate&quot; labor category as defined in the CHESS ITES-3S contract vehicle and possess the following additional qualifications:
<ul>
<li>Seven (7) years of combined experience in DevSecOps, DevOps, SecOps, or MLOps engineering and development.</li>
<li>Five (5) years of hands-on experience designing, securing, implementing, and maintaining cloud environments, preferably within AWS GovCloud, Azure Government, or similarly regulated cloud environments.</li>
<li>Demonstrated experience supporting cloud environments operating under FedRAMP High, DoD Impact Level 5 (IL5), or comparable federal security requirements.</li>
<li>Verifiable experience on at least two (2) projects designing, implementing, and managing Continuous Integration/Continuous Deployment (CI/CD) pipelines using Jenkins, GitLab CI/CD, Azure DevOps, GitHub Actions, or equivalent technologies.</li>
<li>Demonstrated expertise implementing and managing containerization and orchestration technologies, including Docker, Kubernetes, OpenShift, or similar platforms.</li>
<li>Hands-on experience implementing Infrastructure-as-Code (IaC) using Terraform, Ansible, CloudFormation, or comparable automation tools.</li>
<li>Experience configuring and administering cloud-native security capabilities including Web Application Firewalls (WAF), Intrusion Detection/Prevention Systems (IDS/IPS), Security Information and Event Management (SIEM), vulnerability management, and cloud security monitoring solutions.</li>
<li>Verifiable experience analyzing security logs, SIEM data, audit records, and threat intelligence to identify vulnerabilities, investigate security events, and implement corrective actions.</li>
<li>Experience implementing secure Identity and Access Management (IAM), encryption, secrets management, and Zero Trust security principles.</li>
<li>Experience supporting automated monitoring, logging, system performance optimization, and operational sustainment of enterprise cloud platforms.</li>
<li>Strong understanding of DevSecOps best practices, secure software development lifecycle (SSDLC), and cloud security architectures.</li> 
</ul>
Qualifications
<ul>
<li>Active Secret security clearance (required).</li>
<li>Current DoD 8140 (or legacy DoD 8570) cybersecurity certification applicable to privileged access functions (e.g., Security+, CySA+, CASP+, CISSP, CCSP).</li>
<li>AWS Certified DevOps Engineer &ndash; Professional, AWS Security Specialty, Azure DevOps Engineer Expert, Certified Kubernetes Administrator (CKA), or comparable cloud certifications.</li>
<li>Experience supporting AI/ML environments, including AWS SageMaker, Azure Machine Learning, or similar platforms.</li>
<li>Experience with streaming data technologies such as Apache Kafka, AWS Kinesis, or equivalent event-driven architectures.</li>
<li>Familiarity with NIST RMF, DISA STIGs, FedRAMP, Zero Trust Architecture, and DoD cybersecurity compliance requirements.</li></ul></div>

DevSecOps Engineer

Search 5767+ Application security engineer jobs near you this August. New roles added regularly across leading industries. Apply today.