Senior DevSecOps & Application Security Engineer

Senior DevSecOps & Application Security Engineer

Location: LATAM (Remote)

🚀 About Variacode

At Variacode, we connect top-tier tech talent with cutting-edge global projects. We are currently looking for an ambitious, challenge-seeking Senior DevSecOps & Application Security Engineer to join a high-performing team building secure, automated cloud-native pipelines and resilient software architectures.

Our client's technology is used in 80+ countries by Fortune 500 companies (like Home Depot), allowing millions of users to preview products in their own spaces in real-time. If you want to make a massive impact and work on high-traffic, scalable systems, this is your place!

🎯 The Role

Move beyond traditional network administration and compliance auditing. As a Senior DevSecOps & Application Security Engineer, you will be a security-focused software engineer who embeds automated security controls, threat modeling, and secret management directly into the developer workflow without slowing down software delivery speed.

⚙️ What you will do (Responsibilities):

• Embed and automate SAST, DAST, IAST, and Software Composition Analysis (SCA) tooling (such as Snyk, Checkmarx, SonarQube, and Trivy) seamlessly into active CI/CD pipelines.
• Architect and manage robust secret management and identity governance frameworks utilizing HashiCorp Vault, AWS KMS, granular IAM policies, and Open Policy Agent (OPA).
• Lead threat modeling sessions, static code analysis across multi-language codebases, and automated penetration testing to identify and remediate vulnerabilities early.
• Enforce "Compliance as Code" across multi-environment infrastructure leveraging Bridgecrew, Chef InSpec, and custom OPA rules for Terraform.
• Collaborate closely with software engineering teams to educate developers on secure coding best practices and establish frictionless security guardrails.
• Maintain and audit system security controls to align cloud infrastructure with global regulatory benchmarks (such as SOC 2 and HIPAA).

🔍 What we are looking for:Must-haves (Required):

• Experience: 6 to 8+ years of professional experience in DevSecOps, Application Security, or Software Engineering with a strong security automation focus.
• Technical Stack & Tools: SAST/DAST/IAST/SCA (Snyk, Checkmarx, SonarQube, Trivy), HashiCorp Vault, AWS KMS, granular IAM, OPA (Open Policy Agent), Threat Modeling, and Compliance as Code (Bridgecrew, Chef InSpec, OPA for Terraform).
• Key Skills: Security automation, developer workflow integration, threat modeling, static code auditing, and security risk mitigation.
• Language: Fluent English proficiency with excellent technical and conversational communication skills.

Nice-to-haves (Pluses):

• Hands-on development background in Go, Python, or Java.
• Industry security certifications (e.g., CISSP, CISM, Certified DevSecOps Professional, or AWS Certified Security Specialist).
• Direct experience preparing cloud environments for formal SOC 2 Type II or HIPAA audits.

🎁 What we offer:

• Opportunity to work with cutting-edge tech stacks and Fortune 500 clients.
• A highly collaborative, innovation-driven, and remote-first global culture.
• Continuous professional growth and career development pathways.
• Highly competitive USD-denominated compensation package tailored for senior security talent.
• 100% remote flexibility from anywhere in LATAM with aligned US business hours.

📋 What to Expect (Our Hiring Process):

We value your time and believe in a transparent, fast-moving recruitment journey. Here is what our process looks like:

1. Application & AI Screening: Submit your application. Our smart screening tools match your profile against core job requirements.
2. Recruiter Video Call (30 mins): A 1-on-1 video call with a Talent Acquisition Specialist to discuss your background, career goals, and cultural alignment.
3. Variacode Internal Technical Assessment & System Design Interview: A practical technical evaluation followed by an architecture deep-dive conducted by Variacode's internal Technical Lead team, focusing on System Design.

• 💡 Pro-tip for candidates: Be prepared to draw and explain architectural diagrams live during the interview, we recommend practicing beforehand with tools like draw.io or Lucidchart.

1. Client / Partner Interview: Meet directly with the client's engineering or leadership team to align on technical expectations, real-world project challenges, and team synergy.

• 📌 Note: Depending on the client's internal process, they may request an additional client-specific technical assessment or coding exercise during this stage.

1. Offer & Onboarding: Receive your formal offer, sign your agreement, and kick off your onboarding journey with Variacode!