Lead DevSecOps Engineer

We are looking for a skilled Lead DevSecOps Engineer to lead the embedding of security practices into our development and deployment pipelines. In this position, you will architect and deploy secure CI/CD workflows, spearhead vulnerability management efforts, and promote a security-first mindset across engineering teams. Please note that this role requires 3 days of work in the office. Responsibilities Lead the design and rollout of DevSecOps practices across development and deployment pipelines Integrate SAST and DAST tools into the CI/CD toolchain to enable continuous security validation Develop and maintain SBOM frameworks to promote software transparency and compliance Advance software supply chain security initiatives to protect the end-to-end delivery lifecycle Build security integrations, pipeline automation, and tooling for secure CI/CD workflows via scripting languages Operate and tune vulnerability scanning tools to detect, triage, and remediate security risks Apply industry-recognized security frameworks to guide threat modeling and risk mitigation Partner with cross-functional teams to embed security best practices into product development Mentor engineers on secure coding, automation, and modern DevSecOps methodologies Requirements 7-14 years of experience in DevSecOps and product cybersecurity environments Knowledge of SBOM frameworks and their associated toolchains Background in software supply chain security Expertise in vulnerability scanning tools Proficiency in embedding SAST and DAST into CI/CD toolchains Skills in scripting and automation using Python, Bash, or comparable languages for security integrations and pipeline automation Showcase of tools such as Black Duck, Trivy, and SonarQube, or Nexus and similar solutions Familiarity with security frameworks such as OWASP Top 10 and MITRE ATT&CK or equivalents Competency in AWS English proficiency at an Upper-Intermediate level (B2) or above Nice to have Background in regulated industries such as automotive, industrial, or IoT Skills in container security and Kubernetes ecosystems Familiarity with security monitoring and logging platforms such as SIEM or centralized logging solutions