App Sec & DevSecOps Engineer — Remote & Growth‑Oriented

Hidden Jobs; United States; Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Flexible remote options

Hybrid work model

Job summary

Hidden Jobs is seeking a hands-on Security Engineer to embed security across the software development lifecycle and act as a first responder within our security operations function. You will partner with data scientists, engineers, and platform teams to shift security left, automate testing in CI/CD, and triage alerts from cloud and endpoint tools.

You will lead threat modeling, enforce secure-by-design practices, and drive remediation through coaching and governance.

Qualifications

• Proven experience embedding application security and DevSecOps practices into modern software delivery pipelines.
• Hands-on expertise with SAST, DAST, SCA, secrets management, IaC scanning, SBOM, and vulnerability management tooling.
• Operational experience with SecOps platforms such as Microsoft Sentinel, EDR solutions, and cloud-native security monitoring.
• Demonstrated ability to lead threat modeling, communicate risk clearly to both technical and non-technical audiences, and run incident response.
• Comfortable working remotely across Central or Eastern time zones in the US or Canada.

Responsibilities

• Define and champion technical security policies, standards, and guidelines across engineering teams, and act as the subject matter expert on secure-by-design practices.
• Lead threat modeling exercises and identify systemic developer security issues, driving remediation through coaching and structural change.
• Automate static, dynamic, software composition analysis, and vulnerability management within CI/CD pipelines, including signing and attestation of code and artifacts.
• Establish governance for AI-assisted development, ensuring generated code meets internal security standards, alongside best practices for secrets management, IaC security, and SBOM.
• Monitor and triage alerts from SIEM, EDR, and cloud security tools; investigate suspicious activity, differentiate false positives, and execute incident response playbooks.
• Coordinate evidence collection, remediation, and post-incident reviews with engineering, infrastructure, and helpdesk stakeholders.

Skills

Application security

DevSecOps

Threat modeling

Incident response

Security tooling

Tools

SAST

DAST

SCA

Secrets management

IaC scanning

SBOM

Vulnerability management

Microsoft Sentinel

EDR

Job description

Hidden Jobs is seeking a hands-on Security Engineer to embed security across the software development lifecycle and act as a first responder within our security operations function. You will partner with data scientists, engineers, and platform teams to shift security left, automate testing in CI/CD, and triage alerts from cloud and endpoint tools.

You will lead threat modeling, enforce secure-by-design practices, and drive remediation through coaching and governance.