Cyber Security Analyst / DevSecOps Engineer

PSEG Long Island LLC; Bethpage (NY); On-site; USD 120,000 - 160,000; Full time

Job summary

PSEG Long Island LLC is seeking an experienced DevSecOps Engineer to embed security in our DevOps and CI/CD pipelines. You will secure cloud infrastructure, enable automated security testing, and ensure compliance across development and cloud environments.

Role requires strong collaboration with security, infra, and development teams and hands-on experience with SAST/DAST, API security, and container security in a cloud-first context.

Qualifications

• Experience with CI/CD pipelines and security controls.
• Proficiency in SAST/DAST and API security testing.
• Experience with AWS, Azure, or GCP and CSPM tools.

Responsibilities

• Integrate security controls into CI/CD pipelines.
• Develop DevSecOps pipelines with security scanning and compliance checks.
• Implement automated security testing (SAST, SCA, API security).
• Secure container images and artifact repositories (e.g., Artifactory/Nexus).
• Remediate vulnerabilities and support pen tests.
• Support CSPM initiatives and IaC security validation.
• Guide teams on secure coding practices.

Skills

CI/CD Security

CI/CD Platforms

App Security Testing

API Security

Container Security

Cloud Security

CSPM

Cross-functional Communication

Education

BS degree or higher

8+ years DevSecOps experience

Tools

Jenkins

GitHub Actions

GitLab CI/CD

Azure DevOps

Docker

Kubernetes

JFrog Artifactory

Nexus

Job description

We are seeking an experienced DevSecOps Engineer who can build, integrate, and operationalize security within our DevOps processes and CI/CD pipelines. This role will focus on embedding security controls into the software development lifecycle, securing cloud infrastructure, and ensuring that applications and APIs meet enterprise security and compliance requirements.

Using a modern technology stack and agile approach, you will work closely with development, infrastructure, and cybersecurity teams to integrate automated security testing, vulnerability management, and compliance validation across our development and cloud environments.

Job Responsibilities

• Integrate security controls into CI/CD pipelines to enable secure and automated software delivery.
• Develop and maintain DevSecOps pipelines that incorporate security scanning, code analysis, and compliance checks.
• Implement automated security testing including:
• Static Application Security Testing (SAST)
• Software Composition Analysis (SCA)
• API security testing
• Integrate and operationalize code security capabilities including code scanning, secret detection, and dependency vulnerability monitoring.
• Implement and maintain API security controls using tooling to monitor and protect enterprise APIs.
• Support container security practices including image scanning, artifact security, and repository management (e.g., Sonatype Nexus or equivalent).
• Work with development teams to remediate vulnerabilities identified through automated security tooling and penetration testing.
• Implement security best practices for cloud-native architectures, including infrastructure-as-code security validation.
• Support cloud security posture management (CSPM) initiatives to ensure cloud environments remain compliant with security policies and regulatory requirements.
• Develop automation scripts and tooling to support DevSecOps processes.
• Collaborate with security, infrastructure, and development teams to maintain secure deployment pipelines and reduce application security risk.
• Provide guidance and training to development teams on secure coding practices and DevSecOps principles.

Job Specific Qualifications

• BS degree or higher with 4+ years of professional experience in DevOps Engineering or DevSecOps Engineering.
• In place of a degree, candidates with 8+ years of hands-on experience working with DevSecOps tooling, methodologies, and processes will be considered.
• CI/CD Pipeline Security: Proven track record building, securing, and maintaining Continuous Integration and Continuous Deployment (CI/CD) pipelines with integrated security controls.
• CI/CD Platforms: Proficiency with major CI/CD platforms (e.g., Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps).
• Application Security Testing: Direct experience with Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) methodologies.
• API Security: Demonstrated ability implementing API security solutions and protecting application endpoints.
• Container & Artifact Security: Expertise in container security (e.g., Docker, Kubernetes) and managing secure artifact repositories (e.g., JFrog Artifactory, Nexus).
• Cloud Security: Deep background working with public cloud platforms (AWS, Azure, or GCP) and securing cloud infrastructure.
• CSPM: Familiarity with Cloud Security Posture Management (CSPM) tools (e.g., Wiz, Prisma Cloud, Orca Security).
• Core Competencies: Strong professional communication, cross-functional collaboration, and team-building skills.

Desired Skills

• Prior work with Infrastructure as Code (IaC) tools, such as Terraform, CloudFormation, or Ansible.
• Ability to write scripts and automation workflows using Python, Bash, or similar programming languages.
• Familiarity with automated code scanning, dependency scanning, and secret detection / secret management tools.
• Direct exposure to Software Composition Analysis (SCA) tools and open-source vulnerability scanning.
• History of supporting and scaling Secure Software Development Lifecycle (SSDLC) initiatives.
• Practical knowledge supporting IT compliance and cloud governance frameworks, including NIST, CIS Benchmarks, or SOC 2.
• Collaborative background interfacing with Vulnerability Management infrastructure or Penetration Testing teams.