CVS Health
Staff DevSecOps Engineer (Health 100)
$130K–$261K
Work At Home-Massachusetts +3 · Remote · Staff · Full-time · Posted Sep 18, 2026
- Location
- Work At Home-Massachusetts
Work At Home-Connecticut
Work At Home-New York
Work At Home-Rhode Island - Experience
- 7+ years of experience in DevSecOps, application security engineering, platform security or software engineering.
- Education
- Bachelor's degree in Computer Science, Software Development, Software Engineering or a related field, or equivalent practical experience.
About the job
Leads DevSecOps security implementation, tool migrations, automation, and mobile application security across the Health 100 portfolio to improve secure delivery and reduce vulnerabilities.
What you'll do
- Implement and standardize CI/CD security controls, automated scanning, and self-service security tooling.
- Lead security-tool migrations and drive remediation of high-risk vulnerabilities, tracking progress against SLAs.
- Expand application and mobile security testing, report security metrics, and provide technical leadership across teams.
What they ask for
- Integrate security controls such as SAST, SCA, secrets detection, container scanning, or IaC scanning into CI/CD pipelines.
- Lead security implementations or tool migrations in large or complex engineering environments.
- Have proficiency with public cloud platforms and experience with Docker, Kubernetes, Security-as-Code, and Infrastructure-as-Code.
- Have hands-on scripting or programming experience and experience in vulnerability management, software supply chain security, and mobile application security testing.
Nice to have
- Hands-on experience with tools such as Snyk, Checkmarx, Gitleaks, SBOM tooling, Data Theorem, or MobSF.
- Experience in regulated environments or communicating security outcomes to senior leadership.
Pay
$130,295.00 - $260,590.00 USD base salary (or base hourly rate; posting does not specify which applies to this position).
Tools
AWS, Azure, GCP, Docker, Kubernetes, Python, Java, JavaScript
Model-written summary · the original posting is authoritative