DevSecOps and Vulnerability Management Engineer

We are seeking an experienced DevSecOps and Vulnerability Management Engineer to strengthen security practices across development pipelines, cloud infrastructure, and vulnerability management processes. The person in this role will join a newly formed security team supporting a US-based SaaS provider whose platform serves hundreds of public-sector agencies across North America. The role focuses on assessing and improving CI/CD security, establishing unified vulnerability triage and tracking, and delivering clear metrics and reporting to senior leadership.

Responsibilities

• Assess existing CI/CD pipelines and tools, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, and evaluate the effectiveness of currently implemented security scanning tools.
• Design and implement a unified vulnerability triage process to consolidate findings, remove duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.
• Implement end-to-end vulnerability tracking to ensure each finding has an assigned owner and a documented resolution status (remediated, contained, or risk-accepted).
• Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines, and establish security gates to prevent regression.
• Define and enforce branch management and repository hygiene practices to reduce accumulated vulnerabilities and control the growth of security findings.
• Produce regular vulnerability management reports and progress metrics for the CISO and senior leadership, including accurate weekly reporting.
• During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within the DevOps team.
• Coordinate remediation activities across engineering teams and translate technical findings into clear, actionable information for non-technical stakeholders.

Qualifications

• Approximately 8+ years of experience in DevOps or platform engineering, with substantial practical DevSecOps expertise.
• Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.
• Hands-on experience managing vulnerabilities at scale, including aggregation, deduplication, risk-based prioritization, and remediation tracking.
• Strong understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.
• Demonstrated ability to prepare reliable, concise reporting that communicates risk and progress to senior management and non-technical stakeholders.
• Capacity to coordinate cross-team security remediation and to lead technical initiatives during cloud and infrastructure phases.
• Preferred: experience with vulnerability aggregation platforms such as DefectDojo; container and Kubernetes security expertise; knowledge of SBOM, software supply chain security practices (SLSA, Sigstore); familiarity with Azure DevOps or AWS CodePipeline; experience building dashboards or security reporting in Power BI or Datadog.
• Comfortable working in environments that use Java, .NET, Node.js/TypeScript, Ruby, and PHP.

Benefits

• Opportunity to join and shape a dedicated security team for a high-impact SaaS provider serving public-sector clients across North America.
• Remote work
• Unique TEAL culture that values relationships and respect in a non-corporate atmosphere.
• Agile approach with minimal bureaucracy to help you move quickly and deliver value.
• Outstanding integration trips to various places in Europe.
• Activities to support well-being and health.
• Luxmed Gold Extended medical care and Multisport Plus benefit.