The Senior DevSecOps Engineer joins the Engineering Operations team within the Office of the CTO to manage the security health of desktop software products, web applications, and development pipelines. This role involves remediating vulnerabilities in third-party and open-source dependencies by opening pull requests, running automated tests, and troubleshooting compatibility issues. You will maintain SAST, SCA, and DAST scanning integrations within CI/CD pipelines, generate Software Bills of Materials, and coordinate risk assessments with the InfoSec organization. Key technical requirements include proficiency in Python, Git, Windows and Linux environments, and CI/CD tools like Jenkins or Azure DevOps. You will utilize tools such as Black Duck and SonarQube to support a Secure Software Development Lifecycle for 3D modeling software used in semiconductor chip fabrication.
Remediate vulnerabilities in third-party and open-source dependencies by opening and testing pull requests against product code.
Troubleshoot build and compatibility issues caused by dependency upgrades using automated test suites.
Maintain and improve SAST, SCA, and DAST scanning integrations, including scan templates and quality gates within CI/CD pipelines.
Generate and maintain Software Bills of Materials (SBOMs) and track vulnerabilities for released products.
Act as the primary point of contact between Engineering and InfoSec to coordinate risk assessments and security exception requests.
Partner with Application Security Engineers to help developers interpret penetration testing findings and track remediation.
Identify upgrade paths, replacement components, or mitigations to reduce outstanding security exceptions.
What we're looking for
Bachelor’s degree in Computer Science or related field with 8 years experience, Master’s with 6 years, or Associate/equivalent with 10 years in software engineering, DevOps, or application security.
Proficient with Git and source code management platforms such as Bitbucket, GitHub, or Azure Repos.
Proficient in both Windows and Linux environments.
Strong Python skills including dependency management and reading/modifying production code.
Proficient with CI/CD tools such as Jenkins, Azure DevOps, or GitHub Actions.
Proven experience upgrading third-party dependencies in an existing codebase and resolving build, API, and test failures.
Hands-on experience with SCA and SAST tools like Black Duck and SonarQube to triage findings and identify false positives.
Working knowledge of Secure SDLC practices and vulnerability standards such as CVE, CVSS, and the OWASP Top 10.
Clear written communication skills for preparing security documentation and working with security teams.
Experience with containerization technologies such as Docker or Kubernetes (preferred).
Experience with repository managers such as Artifactory (preferred).
Experience with cloud computing services such as Azure, AWS, or GCP (preferred).
Experience with C++ and build systems such as gmake, scons, or cmake (preferred).
Experience with DAST tools such as Invicti (preferred).
Experience generating and managing SBOMs in standard formats such as SPDX or CycloneDX (preferred).
Understanding of open-source license compliance (preferred).
Experience supporting application security reviews, threat modeling, or penetration test remediation (preferred).
Familiarity with Python scientific and engineering libraries (preferred).
Experience managing JavaScript/TypeScript dependencies with npm, including upgrades in Angular applications (preferred).