DevSecOps-AI SSDLC Security Engineer

• Jobseeker Video Testimonials
  
• Employee Glassdoor Reviews
  

We are an IT Solutions Integrator/Consulting Firm helping our clients hire the right professional for an exciting long-term project. Here are a few details.

As a Security Engineer, you will:

• Integrate, configure, and optimizeSAST, SCA, and DASTtools within CI/CD pipelines to automate security testing across build, test, and release stages (including quality gates and exception workflows).
  
• Performstatic, dynamic, and open-source dependency assessmentsto identify vulnerabilities including OWASP Top 10 risks, insecure libraries, exposed secrets, misconfigurations, andsoftware supply-chainweaknesses.
  
• ExecuteAPI security testing(REST/GraphQL) including authentication/authorization validation (OAuth2/OIDC/JWT), input validation, rate limiting/abuse cases, and broken object/function level authorization (BOLA/BFLA), and translate results into developer-ready fixes.
  
• Analyze scan results, remove false positives, prioritize findings based on exploitability and business impact, and provide clear, actionable remediation guidance (secure coding patterns, compensating controls, and verification steps).
  
• Work hands-on with developers, DevOps engineers, architects, and client stakeholders to embedsecure coding,secure design, andshift-left securitypractices, including playbooks, office hours, and remediation sprints.
  
• Supportthreat modelingand security design reviews; convert threats into actionable security requirements, test cases, and engineering backlog items aligned to delivery timelines.
  
• Track vulnerabilities through closure, validate remediation (re-scan, proof of fix, and regression checks), and ensure issues are managed in line with client policy, risk tolerance, and SLA expectations.
  
• Implement additional DevSecOps controls such asIaC scanning,secrets detection,container image scanning, andKubernetes security checks(where applicable), including policy-as-code to prevent insecure deployments.
  
• Strengthensoftware supply-chain securityby supporting SBOM generation/consumption, dependency hygiene, and build/release integrity controls (e.g., artifact signing/verification and provenance where applicable).
  
• Automate repeatable security tasks using scripting (e.g., Python/Bash) and integrations (APIs/webhooks) to improve scan reliability, reporting, and developer workflow adoption.
  
• Design and buildAI agents / agentic workflowsfor AppSec automation (e.g., triage, false-positive suppression, secure code review assistance, threat-model generation, remediation assistance), ensuring appropriate guardrails, logging, and human-in-the-loop validation.
  
• Perform current-state assessments of clientDevSecOpsand emergingAISecOpspractices against industry standards; provide prioritized recommendations and an implementation roadmap.
  
• Perform security testing across modern application surfaces—code, APIs, cloud, containers/Kubernetes—and, where applicable,AI/ML pipelines(e.g., RAG data flows, model integration points, and tool/function calling) using a combination of automated and manual techniques.
  
• Produce security assessment reports, dashboards, trend analysis, and root-cause insights for technical and non-technical stakeholders.
  
• Contribute tosecure SDLC standardsaligned to recognized verification frameworks such asOWASP ASVS
  
• Stay current on emerging threats, AppSec tooling trends, software supply-chain risks, and new attack surfaces introduced by AI-enabled applications and agentic workflows.