We are seeking an experienced DevSecOps and Vulnerability Management Engineer to strengthen security practices across development pipelines, cloud infrastructure, and vulnerability management processes. The person in this role will join a newly formed security team supporting a US-based SaaS provider whose platform serves hundreds of public-sector agencies across North America. The role focuses on assessing and improving CI/CD security, establishing unified vulnerability triage and tracking, and delivering clear metrics and reporting to senior leadership.
Responsibilities
- Assess existing CI/CD pipelines and tools, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, and evaluate the effectiveness of currently implemented security scanning tools.
- Design and implement a unified vulnerability triage process to consolidate findings, remove duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.
- Implement end-to-end vulnerability tracking to ensure each finding has an assigned owner and a documented resolution status (remediated, contained, or risk-accepted).
- Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines, and establish security gates to prevent regression.
- Define and enforce branch management and repository hygiene practices to reduce accumulated vulnerabilities and control the growth of security findings.
- Produce regular vulnerability management reports and progress metrics for the CISO and senior leadership, including accurate weekly reporting.
- During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within the DevOps team.
- Coordinate remediation activities across engineering teams and translate technical findings into clear, actionable information for non-technical stakeholders.
Qualifications
- Approximately 8+ years of experience in DevOps or platform engineering, with substantial practical DevSecOps expertise.
- Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.
- Hands-on experience managing vulnerabilities at scale, including aggregation, deduplication, risk-based prioritization, and remediation tracking.
- Strong understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.
- Demonstrated ability to prepare reliable, concise reporting that communicates risk and progress to senior management and non-technical stakeholders.
- Capacity to coordinate cross-team security remediation and to lead technical initiatives during cloud and infrastructure phases.
- Preferred: experience with vulnerability aggregation platforms such as DefectDojo; container and Kubernetes security expertise; knowledge of SBOM, software supply chain security practices (SLSA, Sigstore); familiarity with Azure DevOps or AWS CodePipeline; experience building dashboards or security reporting in Power BI or Datadog.
- Comfortable working in environments that use Java, .NET, Node.js/TypeScript, Ruby, and PHP.
Benefits
- Opportunity to join and shape a dedicated security team for a high-impact SaaS provider serving public-sector clients across North America.
- Remote work
- Unique TEAL culture that values relationships and respect in a non-corporate atmosphere.
- Agile approach with minimal bureaucracy to help you move quickly and deliver value.
- Outstanding integration trips to various places in Europe.
- Activities to support well-being and health.
- Luxmed Gold Extended medical care and Multisport Plus benefit.