Job
Description
Job Summary:We seek a skilled and motivated DevSecOps Engineer to join our dynamic run team. In this role, he/she will be responsible will include leveraging comprehensive scanning capabilities to identify vulnerabilities, misconfigurations, and compliance issues across our IT environment. He/she will work closely with development, operations, and security teams to integrate security best practices into our CI/CD pipeline and improve our overall security posture. This role requires a strong understanding of offensive and defensive security principles and proficiency in scripting and automation. The ideal candidate is a problem solver, a team player, and passionate about securing modern IT environments. Responsibilities:Vulnerability Scanning and Analysis:Perform regular vulnerability scans of servers, workstations, cloud infrastructure, and other assets using Qualys or Burp. Analyze scan results to identify critical vulnerabilities, misconfigurations, and compliance violations. Prioritize vulnerabilities based on risk and business impact. Manually validate and verify vulnerabilities to reduce false positives and refine scan settings. Remediation and Reporting:Work closely with application teams, system administrators, and other stakeholders to communicate vulnerability findings and guide remediation efforts. Track remediation progress using Excel and other tracking tools. Generate detailed reports on vulnerability trends, remediation status, and overall security posture. Present findings to technical and management audiences. DevSecOps Integration:CI/CD Pipelines:Design, build, and maintain CI/CD pipelines with security integrated throughout the process. Familiarity with tools like Jenkins, GitLab CI, and Azure DevOps. Automate vulnerability remediation tasks using Ansible playbooks. Collaborate with development teams to implement secure coding practices and improve application security. Work with DevSecOps engineers to build out automated security testing pipelines. Automation and Scripting:Develop and maintain Ansible playbooks to automate vulnerability patching, configuration hardening, and compliance checks. Use scripting languages (e.g., Python, Bash) to create custom tools and scripts for vulnerability analysis and reporting. Data Analysis and Visualization:Utilize Power BI to create dashboards and reports that provide management visibility into security posture and remediation efforts. Analyze vulnerability data to identify trends, patterns, and areas for improvement. Present findings to management clearly and concisely. Compliance and Governance:Ensure compliance with relevant security standards and regulations (e.g., PCI DSS, HIPAA, SOC). Assist with security audits and assessments. Stay up to date on the latest security threats and vulnerabilities. Continuous Improvement:Continuously evaluate and improve our vulnerability management processes and procedures. Research and recommend new security tools and technologies. Participate in security incident response activities. Technical Skills and Qualifications:Required:3+ years of experience in security vulnerability scanning and analysis. Expert level experience with Vulnerability Management Strong understanding of vulnerability assessment methodologies and tools (e.g., OWASP, NIST). Proven experience with automation and configuration management. Understand at least one scripting language (e.g., Python, Bash, PowerShell). Experience with integrating security tools into CI/CD pipelines. Excellent working knowledge of Power BI and Excel for data analysis and reporting. Ability to create complex dashboards and reports. Solid understanding of networking concepts, operating systems (Windows, Linux), and cloud environments (e.g., AWS, Azure, GCP). Excellent communication, collaboration, and problem solving skills. Ability to work independently and as part of a team. Preferred:Some experience with other security tools such as Burp Suite, Invicti, SonarQube, Zap, et
