Sr. Security Engineer

Role overview

Lead the security tooling and controls that assess software throughout development and deployment. You will translate compliance requirements into risk-based automated checks that give engineers useful feedback early, while helping expand security testing and incident response capabilities. The position supports regulated and security-sensitive systems, including government customer environments, and works closely with engineering and cybersecurity leaders.

Responsibilities - Own and improve pipeline security tooling for code analysis, dependency risks, secrets detection, container scanning, and artifact signing. - Assess tool coverage and effectiveness, address gaps, and guide tool selection, configuration, and the long-term security tooling roadmap. - Map compliance and risk framework requirements to pipeline controls, thresholds, exceptions, and evidence for reviews or authorizations. - Develop automated and manual penetration testing with fast feedback to engineering teams. - Help build security operations and incident response processes with appropriate automation and human review. - Use scripting and AI-assisted methods where they can improve security workflows, triage, or remediation quality.

Requirements - At least seven years in DevSecOps, application security, security operations, incident response, or security engineering, including three years owning CI/CD security tooling. - Hands-on experience configuring and enforcing code analysis, software composition analysis, secrets detection, and container scanning in production pipelines. - Experience mapping security controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements and preparing assessment or authorization evidence. - Demonstrated ability to evaluate and evolve security tools and influence engineering teams without direct authority. - Scripting or automation experience in Python, Bash, or similar. - Security+ or an equivalent DoD 8140 qualifying certification, or ability to obtain one within two months of hire; must be a U.S. citizen residing and working in the United States.

Nice to have - Familiarity with GitHub, Argo CD, JFrog, Snyk, cloud and container environments, or government DevSecOps software factories. - Experience supporting ATO efforts, including control assessments and POA&M management, or using software supply-chain controls such as SBOMs and policy as code. - Experience applying AI or language models to security engineering, penetration testing, or advanced security certifications; an active clearance is desirable.

Benefits and work setup - The listed salary range is $135,000–$220,000 annually. The role may also include bonuses, equity, and benefits; compensation varies with experience, qualifications, location, and business needs.