DevSecOps and Vulnerability Management Engineer

WISE INTEGRATION; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

Wise Integration seeks a Senior DevSecOps and Vulnerability Management Engineer to strengthen security across development pipelines, cloud infra, and vulnerability management. The role starts with threat modelling, then leads vulnerability fixes, hardens CI/CD gates, and consolidates identity services for a diverse estate running on Azure and AWS.

The ideal candidate has 8+ years of DevOps/Platform experience, hands-on vulnerability management, and strong reporting skills for leadership.

Qualifications

• Approximately 8+ years of DevOps or platform engineering experience with strong DevSecOps expertise.
• Automated CI/CD security gates using GitHub Actions or Jenkins.
• Hands-on vulnerability management at scale with remediation tracking.
• Familiar with CVSS, EPSS, CISA KEV for risk-based prioritization.
• Ability to report clearly to non-technical stakeholders and leadership.
• Coordinate security remediation across engineering teams.
• Experience with DefectDojo or similar platforms.
• Container and Kubernetes security knowledge.
• SBOM, software supply chain security (SLSA, Sigstore) exposure.
• Experience with Azure DevOps or AWS CodePipeline.
• Dashboard/reporting development using Power BI or Datadog.

Responsibilities

• Assess existing CI/CD pipelines and security scanning tools (GitHub Actions, Jenkins, ArgoCD, Helm, CodePipeline).
• Establish unified vulnerability triage, deduplicate findings, and prioritize risks.
• Implement end-to-end vulnerability tracking with ownership and resolutions.
• Integrate SAST, SCA, secrets detection, container security, and IaC scanning in CI/CD with gates.
• Establish branch management and repository hygiene to curb vulnerabilities.
• Deliver weekly vulnerability reports and progress metrics to CISO and leadership.
• Phase 2: lead cloud/infrastructure engineering activities and vulnerability mgmt within DevOps.

Skills

DevSecOps expertise

CI/CD security

Vulnerability management

Risk-based prioritization

Stakeholder reporting

Remediation coordination

Tools

GitHub Actions

Jenkins

ArgoCD

Helm

AWS CodePipeline

DefectDojo

Power BI

Datadog

Azure DevOps

Job description

Описание: Our client is an international IT company seeking an experienced Senior DevSecOps and Vulnerability Management Engineer to strengthen security practices across its development pipelines, cloud infrastructure, and vulnerability management processes. The client is building a dedicated security team for a US-based SaaS provider whose platform serves hundreds of public-sector agencies across North America. The programme covers a large, varied estate of around a dozen product lines, running on Java, .NET, Node/TypeScript, Ruby and PHP across Azure and AWS, including legacy systems that need framework upgrades rather than quick patches. The work starts with a short phase where senior engineers do threat modelling and map the estate. A larger team then fixes vulnerabilities, hardens cloud infrastructure, builds security gates into CI/CD pipelines and consolidates identity services. Engineers work hands‑on with modern AI coding tools and learn security from experienced tower leads. It’s a strong fit for good software, cloud and DevOps engineers who want to grow into application security. The team works in English, with partial overlap with US Eastern time. The Project The project focuses on establishing a centralized, risk-based vulnerability management framework, integrating automated security checks into CI/CD pipelines, and improving the accuracy and transparency of security reporting. The engagement consists of two phases. During Phase 1, the engineer will lead vulnerability management improvements and DevSecOps security integration. In Phase 2, the role will transition into a leadership position within the client’s DevOps team, overseeing cloud and infrastructure engineers and a vulnerability management analyst.

Задачи

• Assess existing CI/CD pipelines, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, along with currently implemented security scanning tools.
• Establish a unified vulnerability triage process to consolidate findings, eliminate duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.
• Implement end‑to‑end vulnerability tracking, ensuring each finding has a designated owner and a documented resolution status (remediated, contained, or risk‑accepted).
• Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure‑as‑code scanning into CI/CD pipelines, including security gates to prevent regression.
• Establish branch management and repository hygiene practices to reduce accumulated vulnerabilities and prevent uncontrolled growth of security findings.
• Deliver accurate weekly vulnerability management reports and progress metrics to the CISO and senior leadership.
• During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within the DevOps team.

Требования

• Approximately 8+ years of experience in DevOps or platform engineering, with strong practical DevSecOps expertise.
• Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.
• Hands‑on experience managing vulnerabilities at scale, including findings aggregation, deduplication, risk‑based prioritization, and remediation tracking.
• Strong understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.
• Ability to transform complex security findings into reliable, actionable reporting for non‑technical stakeholders and senior management.
• Ability to coordinate security remediation activities across engineering teams.
• Experience with vulnerability aggregation and management platforms such as DefectDojo.
• Container and Kubernetes security expertise.
• Knowledge of software bill of materials (SBOM), software supply chain security, SLSA, and Sigstore.
• Experience with Azure DevOps or AWS CodePipeline.
• Dashboard development and security reporting using Power BI or Datadog.

Additional Info

Location: Lithuania or Poland Start date: ASAP Contract duration: 12 months