Senior DevSecOps Engineer, Justworks
$188-242k
Business operations platform
Be an early applicant
Business operations platform
1001+ employees
Be an early applicant
$188-242k
1001+ employees
Company mission
To help entrepreneurs and businesses grow with confidence.
Role
Who you are
- You believe the secure path should be the easy path. You've spent your career where security and engineering meet, and you've learned that scanners nobody reads and gates nobody can pass don't make software safer, they make engineers route around you
- So you build guardrails instead: pipelines that catch vulnerabilities before a human ever has to, golden paths with security baked in, and automation that turns "did we patch that?" from a meeting into a dashboard
- You're comfortable in a CI/CD pipeline, an AWS account, and a Kubernetes cluster. You can read application code well enough to tell a real injection risk from scanner noise, and you'd rather fix the template that generated the bug than file 40 tickets about it
- As a Senior DevSecOps Engineer, how results are achieved is paramount for your success and ultimately result in our success as an organization. In this role, your foundational knowledge, skills, abilities and personal attributes are anchored in the following competencies:
- Good judgement - the exercise of critical thinking, analyzing and assessing problems and implications, identifying patterns, making connections of underlying issues, understanding risks and developing mitigation strategies, and taking ownership of the outcome
- Resourcefulness - taking a can-do approach, even in the face of obstacles and constraints by assessing what’s in front of you and effectively and efficiently optimizing what you have, whether it's working on something new or thinking about how to do something better
- Teamwork and communication - putting our collective best together through documentation, collaboration, relationship-building, listening, empathy, recruiting, and evangelism.Influence and leadership - fostering a community of knowledge-sharing, collaboration, mentorship, and forward-thinking
- Skills and knowledge - the capacity to actively learn and apply specific domain knowledge, know-how, and best practices to continually enhance and improve
- 5+ years of professional experience in software engineering, infrastructure, or security engineering
- 3+ years focused on application security, security automation, or DevSecOps practice
- Hands-on experience integrating security tooling into CI/CD pipelines (GitHub Actions strongly preferred): SAST, SCA, secrets detection, container scanning
- Proficiency with AWS and its security services (IAM, GuardDuty, Security Hub, CloudTrail); you understand cloud identity well enough to design least-privilege access, not just audit it
- Experience with Kubernetes and infrastructure-as-code (Terraform preferred), including policy-as-code enforcement
- Proficiency in at least one programming language (Go, Python, or Ruby preferred); you build tooling, not just configure it
- Demonstrated ability to reduce security friction for engineers, with examples of controls teams adopted willingly
- Strong written communication; you document as you build
What the job involves
- This is a foundational role. You'll be one of the first dedicated DevSecOps engineers on a platform organization supporting 300+ engineers, working alongside our Developer Experience and SRE teams and partnering closely with the Security organization. You'll shape how secure software gets built here, not just review it after the fact – including how we use AI to find and fix vulnerabilities before they reach production
- Security is primarily responsible for discovering, prioritizing, and reporting on risk posture; Engineering is primarily responsible for remediation. This role lives at that seam — partnering with Digital Security on coverage, and driving the fixes through Engineering
- This role reports to Platform Engineering but has a dotted line reporting to Digital Security leadership
- Own security automation across our CI/CD pipelines (GitHub Actions): SAST, SCA, secrets detection, and container scanning that runs fast and flags things worth fixing
- Build security into our golden path templates for Go, Rails, and Vue.js services, so new services start secure by default
- Harden our software supply chain: dependency management, artifact signing, SBOM generation, and provenance for what we ship
- Implement and tune infrastructure-as-code scanning (Terraform) and Kubernetes policy enforcement, catching misconfigurations before they reach an environment
- Coordinate vulnerability exposure remediation across all of Engineering, including code vulnerabilities, infrastructure configuration changes, and patching
- Build vulnerability management automation that routes findings to owning teams with context, deduplicates noise, and tracks remediation without spreadsheets
- Own implementation of secrets management patterns and tooling, and drive the elimination of long-lived credentials in favor of short-lived, federated identity
- Partner with the Security team on cloud security posture across our AWS environments, and make sure Platform's telemetry gives Detection & Response what they need
- Support Security's rollout of agentic penetration testing, and build the auto-remediation that turns vulnerability findings into fixes before they can be exploited
- Explore and roll out AI-assisted security review of code changes, with guardrails that keep signal high and false positives low
- Drive adoption through documentation and developer education, because a control nobody understands is a control nobody follows
- Measure what matters: time-to-remediate, scan coverage, secrets findings, and mean time to patch, so we can see whether we're actually getting safer
- Serve as an advocate for secure development practices, defining how secure software is engineered
Our take
Justworks operates in an increasingly crowded space of all-in-one business operation suites, that include tools like human resources, payroll, employee management, benefits, and others that businesses critically need to operate as they scale.
Globally, human resource management has become an extremely fertile field, creating great opportunity for Justworks to continue to grow. The company is regarded as a market leader, but does see competition in the shape of Paychex Flex, Rippling, Paylocity, and TriNet, among others.
Justworks' solutions have proven extremely popular with SMEs, and this has not gone unnoticed by investors - with the company picking up considerable amounts of funding. The company is known to have sights on going public, though these were delayed somewhat by market conditions. That said, it has continued to expand operations and acquired Via in 2024, signalling that its going strong.
Steph
Company Specialist at Welcome to the Jungle
Insights
24% employee growth in 12 months
Company
Funding (last 2 of 7 rounds)
Nov 2023
$16.9m
LATE VC
Jan 2020
$50m
SERIES E
Total funding: $159.9m
Company benefits
- Paid volunteer work
- Paid parental leave
- Work from home opportunities
- Medical, dental, and vision insurance, plus access to One Medical, Kindbody, and Teladoc
- Premium access to Headspace, ClassPass stipends, and webinars to support your overall wellness on topics like nutrition, budgeting, mindfulness, and more
- All Justworks offers include equity, and Justworkers can continue to earn more over time with promotions and tenure
- Extensive learning & development opportunities through workshops, ExecOnline, Udemy, and BetterUp coaching
- Apprenticeship program that supports internal movement and growth
Company HQ
Fulton Ferry District, NY
Leadership
Isaac Oates
(Founder & Director)Experience as a Senior Product Manager at Amazon before founding Adtuitive and serving as COO for a year. Left this position to spend 3 years as a VP at Etsy, before founding Justworks.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 51 more jobs at Justworks