DevSecOps Engineer

We are seeking an experienced DevSecOps and Vulnerability Management Engineer to strengthen security practices across development pipelines, cloud infrastructure, and vulnerability management processes. The person in this role will join a newly formed security team supporting a US-based SaaS provider whose platform serves hundreds of public-sector agencies across North America.

focuses on assessing and improving CI/CD security, establishing unified vulnerability triage and tracking, and delivering clear metrics and reporting to senior leadership.

Assess existing CI/CD pipelines and tools, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS Code

Pipeline, and evaluate the effectiveness of currently implemented security scanning tools. Design and implement a unified vulnerability triage process to consolidate findings, remove duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators. Implement end-to-end vulnerability tracking to ensure each finding has an assigned owner and a documented resolution status (remediated, contained, or risk-accepted).

Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines, and establish security gates to prevent regression. Define and enforce branch management and repository hygiene practices to reduce accumulated vulnerabilities and control the growth of security findings