We are seeking an experienced DevSecOps and Vulnerability Management Engineer to strengthen security practices across development pipelines, cloud infrastructure, and vulnerability management processes. The person in this role will join a newly formed security team supporting a US-based SaaS provider whose platform serves hundreds of public-sector agencies across North America. The role focuses on assessing and improving CI/CD security, establishing unified vulnerability triage and tracking, and delivering clear metrics and reporting to senior leadership.

Responsibilities

  • Assess existing CI/CD pipelines and tools, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, and evaluate the effectiveness of currently implemented security scanning tools.

  • Design and implement a unified vulnerability triage process to consolidate findings, remove duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.

  • Implement end-to-end vulnerability tracking to ensure each finding has an assigned owner and a documented resolution status (remediated, contained, or risk-accepted).

  • Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines, and establish security gates to prevent regression.

  • Define and enforce branch management and repository hygiene practices to reduce accumulated vulnerabilities and control the growth of security findings.

  • Produce regular vulnerability management reports and progress metrics for the CISO and senior leadership, including accurate weekly reporting.

  • During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within the DevOps team.

  • Coordinate remediation activities across engineering teams and translate technical findings into clear, actionable information for non-technical stakeholders.

Qualifications

  • Approximately 8+ years of experience in DevOps or platform engineering, with substantial practical DevSecOps expertise.

  • Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.

  • Hands-on experience managing vulnerabilities at scale, including aggregation, deduplication, risk-based prioritization, and remediation tracking.

  • Strong understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.

  • Demonstrated ability to prepare reliable, concise reporting that communicates risk and progress to senior management and non-technical stakeholders.

  • Capacity to coordinate cross-team security remediation and to lead technical initiatives during cloud and infrastructure phases.

  • Preferred: experience with vulnerability aggregation platforms such as DefectDojo; container and Kubernetes security expertise; knowledge of SBOM, software supply chain security practices (SLSA, Sigstore); familiarity with Azure DevOps or AWS CodePipeline; experience building dashboards or security reporting in Power BI or Datadog.

  • Comfortable working in environments that use Java, .NET, Node.js/TypeScript, Ruby, and PHP.

Benefits

  • Opportunity to join and shape a dedicated security team for a high-impact SaaS provider serving public-sector clients across North America.

  • Remote work

  • Unique TEAL culture that values relationships and respect in a non-corporate atmosphere.

  • Outstanding integration trips to various places in Europe.

  • Activities to support well-being and health.

  • Luxmed Gold Extended medical care and Multisport Plus benefit.