DevSecOps Engineer

• As a DevSecOps Engineer, you will help secure Virta’s applications and platform, directly contributing to the trust our members and partners place in us
• You’ll collaborate across teams to ensure security is a seamless part of our development lifecycle
• Improve Security Design: Help assess our current security controls within GCP and Kubernetes, identify areas for improvement, and contribute to the maturation of our security posture from good to great
• Champion Secure Development: Partner closely with Engineering, Product, and Platform teams to integrate security best practices early and often (“shift-left”) into the software development lifecycle
• Build and Automate: Design, implement, and manage security tooling and automation to streamline vulnerability detection, remediation, and compliance verification. Replace manual processes with efficient, automated solutions
• Refine Access Control: Evolve our identity and access management (IAM) strategy, ensuring least-privilege access and robust auditing capabilities across our systems
• Strengthen Network Security: Continuously improve our network security architecture, policies, and controls within our cloud environment
• Develop Clear Standards: Establish, document, and communicate practical security policies, standards, and guidelines for engineering teams
• Support Security Initiatives: Drive vulnerability management efforts and enhance our incident response preparedness, ensuring we are ready to handle potential threats effectively
• Cultivate Security Awareness: Act as a security evangelist, promoting security awareness and best practices throughout the engineering organization
• Joining a new company and stepping into a foundational role takes time. Here’s what you can expect as you get started and begin making your mark:
• Immerse Yourself: Your initial focus will be on understanding Virta’s culture, our mission, our engineering workflows, and the nuances of our cloud platform (GCP/Kubernetes). You’ll connect with key engineers and stakeholders across different teams
• Learn the Landscape: You’ll dive into our existing systems, CI/CD pipelines, and current security tooling and configurations to get a clear picture of where we stand today
• Assess & Identify Opportunities: Leveraging your expertise, you’ll begin evaluating our current security posture, including critical areas like our IAM implementation (RBAC), data security practices, network controls, and existing security policies. You’ll help identify high-impact areas for improvement
• Start Building: You’ll quickly move into hands-on work, likely starting with foundational projects such as refining IAM roles, enhancing specific security configurations, or beginning to develop key security automation or documentation

Benefits

• Remote-first work environment with ability to work from home
• Flexible work hours & time off policy
• Virta pays 99% of all employee health insurance premiums, and 75% for all dependents
• Up to 16 weeks paid parental leave
• Enroll in the Virta treatment for free and give a discount to friends and family
• Internet, home office, learning & development stipends
• Employee Resource Groups like Parents of Virta, Ladies of Virta, and Virtans for DEI
• 401K and ROTH contribution opportunities- Proficiency in Infrastructure as Code (IaC) tools, specifically Terraform
• Hands-on experience in application security, including secure coding practices, vulnerability management, and security testing (SAST, DAST, IAST); exposure to threat modeling is a plus
• Strong communication skills with the ability to clearly articulate complex security concepts to diverse audiences and influence technical direction across teams
• Strong grasp of networking concepts, identity management (IAM), encryption, and common web application vulnerabilities (e.g., OWASP Top 10)
• Development experience with Go and/or Python
• 5-7+ years of experience with 2+ at a high growth startup or similar environment
• Understanding and practical experience in securing cloud-native applications and infrastructure, particularly in Kubernetes environments. GCP experience is strongly preferred