Senior Security Engineer, Istari

• 7+ years in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years owning security tooling in continuous integration and continuous delivery (CI/CD) pipelines
• Deep hands-on experience configuring, tuning, and enforcing SAST, SCA, secrets detection, and container scanning tools in production pipelines, including risk-based gates, vulnerability thresholds, and exception processes
• Demonstrated experience mapping security tooling and pipeline controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements, and producing evidence for assessments or authorizations
• Track record of evaluating, selecting, or evolving security tooling, and influencing engineering teams without direct authority
• Scripting or automation experience in Python, Bash, or similar
• Security+ or equivalent Department of Defense (DoD) 8140 qualifying certification, or ability to obtain within 2 months of hire
• U.S. citizen residing and working in the U.S

Desirable

• We are seeking a Senior Security Engineer to lead and advance the security tooling that tests and validates our software against compliance and cybersecurity standards.
• In this role, you will ensure our toolchain is consistently enforced, highly trustworthy, and continuously enhanced as our products, customer base, and regulatory requirements expand. You will also be a key early contributor as we design and implement our application security and security operations functions
• You will be the technical authority for how security checks are configured, tuned, and enforced across our software development lifecycle (SDLC).
• You will translate compliance and Risk Management Framework (RMF) requirements into automated, risk-based controls that give engineers fast, actionable feedback early in development. Your expertise in AI-based automation will be key to success.
• The goal is a pipeline calibrated to the speed of organizational need: secure by default, automated wherever possible, and supported by clear human review when automation flags risk
• On the other end of the SDLC, you will help implement automated and manual pen-testing and other security-related testing capabilities across a range of deployment environments.
• You will help develop our security operations capabilities with faster and more automated incident response and incident management. Applying an AI-first approach to these functions will enable faster, more efficient, higher-quality outcomes
• This role supports regulated and security-sensitive environments, including systems hosted for Government customers, and partners closely with engineering, product, and cybersecurity leadership
• Serve as the technical owner of our pipeline security tooling, including static application security testing (SAST), software composition analysis (SCA), secrets detection, container scanning, and artifact signing
• Assess tooling effectiveness and coverage, identify gaps, and recommend and lead improvements, consolidation, or replacement as needs evolve
• Develop automated and manual pen-testing capabilities with rapid feedback loops into the engineering process
• Help mature the security operations and incident response capabilities of the company
• Define the long-term roadmap for security tooling and processes in partnership with Cybersecurity and Engineering leadership
• Translate National Institute of Standards and Technology (NIST) SP 800-53, NIST SP 800-171, and RMF control requirements into enforceable pipeline gates, thresholds, and policies
• Evolve and maintain risk-based pass/fail criteria that balance security assurance with delivery speed and minimize false positives
• Ensure tooling outputs produce assessor-ready evidence that supports authorizations, continuous monitoring, and audits
• Own the exception and manual-review process for findings that fail automated checks, so decisions are documented and traceable
• Ensure security results cannot be bypassed or tampered with, including enforcement of artifact signing, signature verification before deployment, commit signing, branch protection, and repository rulesets
• Automate the creation and maintenance of software bills of materials (SBOMs) and vulnerability exploitability exchange (VEX) data for delivered software
• Move security checks to the earliest practical point (developer workstation, pre-commit, pull request, etc.)
• Partner with engineering teams to embed security into their workflows, supported by clear standards and guidance, so the secure path is the easy path
• Apply artificial intelligence (AI) tooling to accelerate vulnerability triage, remediation, and security automation, and evaluate emerging AI capabilities for the toolchain