DevSecOps Engineer, Material Bank

• At least 8 years’ experience in information technology, information security administration or security operations
• Understanding of OWASP, CVSS, the MITRE ATT&CK framework and the software development lifecycle (SLDC)
• Experience with agile workflows, including Scrum and Kanban
• Experience with DevSecOps implementations (SAST, SCA and/or DAST)
• Experience with Amazon Web Services (AWS) security and operations
• Strong knowledge on containerization and orchestration tools like Docker and Kubernetes
• Certifications – CISSP, AWS Certified Cloud Practitioner

Desirable

• The DevSecOps Engineer supports continuous integration and continuous deployment (CI/CD) initiatives and is an integrated team member working with software developers, system engineers, cybersecurity engineers and systems administrators
• The DevSecOps Engineer acts as a liaison with Software Development and Development Operations (DevOps) to understand strategy, execution and production support
• The role is heavily security-focused and ingrained in the CI/CD pipeline automation to deliver security principles and validation at all times
• Assist in the development and implementation of CI/CD security strategy and practices in tandem with other technical team leads
• Build relationships with developers, stakeholders and scrum masters to incorporate security principles into engineering design and deployments
• Build services and tools to enable developers and engineers to easily use security components produced by application security team members
• Enrich DevOps architecture with security standards, best practices and automations
• Serve as a point of contact for security-based escalations and remain tightly involved through resolution
• In-depth understanding of TCP/IP, computer networking, routing and switching
• Solid experience with firewall and intrusion detection/prevention protocols
• Influence secure API development standards and implementations across multiple platforms
• Define security testing strategy and implement technologies and processes to support the strategy
• Coordinate ethical hacking & penetration testing exercises
• Supervise testing and validation in application security controls across projects
• Build services and tools to enable developers and engineers to easily use security components produced by application security team members
• Simplify automation that applies security inter-workings with CI/CD pipelines
• Support the ability to “shift left” and incorporate security early on and throughout the development lifecycle
• Identify vulnerabilities in code through automated and manual assessments, and promote quick remediation
• Partner with teams to define key performance indicators (KPIs) and metrics across business units