Sr. Security Engineer

What you'll do

• Own and improve pipeline security tooling, controls, testing, and the security tooling roadmap.
• Translate NIST and RMF requirements into risk-based pipeline gates, assessor-ready evidence, and documented exception processes.
• Advance shift-left security and use AI to automate vulnerability triage, remediation, and security operations.

What they ask for

• 7+ years in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years owning security tooling in CI/CD pipelines.
• Hands-on experience configuring and enforcing SAST, SCA, secrets detection, and container scanning tools in production pipelines.
• Experience mapping tooling and pipeline controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements and producing assessment or authorization evidence.
• Scripting or automation experience in Python, Bash, or similar; Security+ or equivalent DoD 8140 qualifying certification, or ability to obtain within 2 months; U.S. citizenship and U.S. residence and work.

Nice to have

• Familiarity with GitHub, Argo CD, JFrog, and Snyk; experience in DoD or Government DevSecOps environments.
• Experience with ATOs, software supply chain integrity, policy-as-code, AI/LLM security tools, penetration testing, cloud/container environments, advanced certifications, or an active security clearance.

Pay

USD 135,000–220,000 (per-year-salary) — base salary

Tools

SAST, SCA, Python, Bash, GitHub, Argo CD, JFrog, Snyk

AI focus

Apply AI tooling to accelerate vulnerability triage, remediation, and security automation; evaluate emerging AI capabilities for the toolchain and security operations.