Lead DevSecOps Engineer

We are seeking an experienced Lead DevSecOps Engineer to drive the integration of security practices into our development and deployment pipelines. In this role, you will design and implement secure CI/CD workflows, lead vulnerability management initiatives, and champion a security-first culture across engineering teams.

Please note that this role requires 3 days of work in the office.

Responsibilities

• Lead the design and implementation of DevSecOps practices across development and deployment pipelines
• Integrate SAST and DAST tools into the CI/CD toolchain to ensure continuous security validation
• Develop and maintain SBOM frameworks to support software transparency and compliance
• Drive software supply chain security initiatives to safeguard the end-to-end delivery lifecycle
• Build security integrations, pipeline automation, and tooling for secure CI/CD workflows using scripting languages
• Operate and optimize vulnerability scanning tools to identify, triage, and remediate security risks
• Apply industry-recognized security frameworks to guide threat modeling and risk mitigation
• Collaborate with cross-functional teams to embed security best practices into product development
• Mentor engineers on secure coding, automation, and modern DevSecOps methodologies

Requirements

• 7-14 years of experience working in DevSecOps and product cybersecurity environments
• Knowledge of SBOM frameworks and associated toolchains
• Background in software supply chain security
• Hands-on expertise in vulnerability scanning tools
• Proficiency in integrating SAST and DAST into CI/CD toolchains
• Strong scripting and automation skills using Python, Bash, or similar languages for security integrations and pipeline automation
• Hands-on experience with tools such as Black Duck, Trivy, and SonarQube, or Nexus and similar solutions
• Familiarity with security frameworks such as OWASP Top 10 and MITRE ATT&CK or similar
• Competency in AWS
• English proficiency at an Upper-Intermediate level (B2) or higher

Nice to have

• Experience working in regulated industries such as automotive, industrial, or IoT
• Skills in container security and Kubernetes environments
• Familiarity with security monitoring and logging tools such as SIEM or centralized logging platforms