DevSecOps Engineer

Platform. Remote. Full-time. 4+ years. Hiring now.

You own security across the whole platform. Product engineers build and run their own services; the Site Reliability Engineer owns whether the system is up and fast. You own whether it is secure: the pipeline gates, the vulnerability backlog, the guardrails every team ships through, and the compliance posture that proves it to a customer.

This is a build-and-own role, not a policy desk. You write the checks, you fix the findings or get them fixed, and you raise how much of it an agent handles on its own. It is desk work done during business hours, separate from incident firefighting.

What makes it different

The scanning and the first-pass fixes are already an agent's job. A monthly audit reads every repo, scores findings by severity and exploitability, and files them. A capped fix machine turns a bounded number of findings a day into tested pull requests. You set the standards, you review and merge, and you build the system that closes findings faster than they open. If you want to run a vulnerability spreadsheet by hand, this is not it. If you want to own the machine that keeps the whole platform secure, it is.

What you own

• The CI security gates across every repo: secret scanning, dependency and image scanning, infrastructure-as-code misconfiguration, and static analysis. You own what blocks a merge and what only warns.
• Vulnerability management: triage by severity and exploitability, drive remediation to a target window, and keep the critical count at zero.
• The merge gates and guardrails: branch protection, code-owner review, protected pipeline files, and the standards each product engineer secures their own service against.
• Secrets and supply chain: how secrets are stored and rotated, and the provenance of what ships.
• Cluster security posture and CSPM, in partnership with the SRE who owns the cluster's reliability.
• Compliance posture: the controls, the evidence, and the audits a customer's security review depends on.
• The security routines and the fix machine: own their output, raise their coverage, and lift how much they close without a human.

Where SRE ends and DevSecOps begins

The Site Reliability Engineer owns reliability: uptime, latency, capacity, incidents, and the cluster underneath. You own security: the gates, the findings, the guardrails, and the posture. Product engineers still secure the service they ship; you own the cross-cutting program that makes that possible and provable. The two roles share the platform and the on-call ladder, and the line between them is clear: is it up and fast, or is it secure.

You are

• 4+ years in security or DevSecOps, with real remediation behind you, not just findings filed.
• Fluent with the scanner stack: secret, dependency, image, IaC, and SAST tooling, and comfortable tuning what blocks versus warns.
• Able to code the fix, not only name the risk. You open the pull request.
• Grounded in a framework (CWE, CVSS, SSDF, SOC 2) without hiding behind it.
• Strong on cloud and Kubernetes security: IAM, network policy, cluster posture, supply chain.
• AI-native: you drive the scanning and fixing agents and raise what they handle on their own.

Tech stack

• The scanner stack: secret scanning, dependency and image scanning, IaC and static analysis across the CI.
• AWS and Kubernetes (EKS), GitOps, and the security routines and fix machine that run on the repos.
• Claude Code to build the guardrails and close findings at the pace they open.

On-call and pay

You share the platform on-call ladder with the SRE, for the security side of an incident. As with the SRE role, the ownership is priced into base pay, there are no fixed hours, and you own an outcome, not a shift. The job is to make the incidents you would be paged for rare.

To apply, email us your resume.