DevSecOps and Vulnerability Management Engineer

Your ITeams Sp. z o.o.; United States; Remote; USD 140,000 - 180,000; Full time

Benefits offered by this job

Luxmed Gold Extended medical care and

Multisport Plus benefit

Job summary

Your ITeams Sp. z o.o.

is seeking an experienced DevSecOps and Vulnerability Management Engineer to strengthen security across development pipelines, cloud infrastructure, and vulnerability management for a US-based SaaS provider serving hundreds of public-sector agencies across North America. The role focuses on assessing and improving CI/CD security, establishing unified vulnerability triage and tracking, and delivering clear metrics and reporting to senior leadership.

Qualifications

• 8+ years in DevOps or platform engineering with strong DevSecOps focus.
• Experience automating CI/CD security gates (GitHub Actions or Jenkins).
• Experience managing vulnerabilities at scale with triage, deduplication and remediation tracking.
• Knowledge of CVSS, EPSS, and CISA KEV prioritization frameworks.
• Ability to prepare concise risk reports for senior management and non-technical stakeholders.
• Ability to coordinate cross-team remediation and lead cloud/infrastructure phases.

Responsibilities

• Assess CI/CD pipelines and tools (GitHub Actions, Jenkins, ArgoCD, Helm, AWS CodePipeline) and evaluate security scanning tools.
• Design a unified vulnerability triage process with deduplication and risk-based prioritization.
• Implement end-to-end vulnerability tracking with owner assignment and documented status.
• Integrate SAST, SCA, secrets detection, container security, and IaC scanning into CI/CD pipelines.
• Define branch management and repository hygiene to reduce findings.
• Produce weekly vulnerability reports for the CISO and leadership.
• Lead cloud and infrastructure engineering and vulnerability operations during Phase 2.
• Coordinate remediation across engineering teams and translate findings for non-technical stakeholders.

Skills

DevSecOps

CI/CD Security

Vulnerability Management

Executive reporting

Cross-team coordination

Tools

DefectDojo

Power BI

Datadog

Job description

DevSecOps and Vulnerability Management Engineer

We are seeking an experienced DevSecOps and Vulnerability Management Engineer to strengthen security practices across development pipelines, cloud infrastructure, and vulnerability management processes. The person in this role will join a newly formed security team supporting a US-based SaaS provider whose platform serves hundreds of public-sector agencies across North America. The role focuses on assessing and improving CI/CD security, establishing unified vulnerability triage and tracking, and delivering clear metrics and reporting to senior leadership.

Responsibilities

• Assess existing CI/CD pipelines and tools, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, and evaluate the effectiveness of currently implemented security scanning tools.
• Design and implement a unified vulnerability triage process to consolidate findings, remove duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.
• Implement end-to-end vulnerability tracking to ensure each finding has an assigned owner and a documented resolution status (remediated, contained, or risk-accepted).
• Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines, and establish security gates to prevent regression.
• Define and enforce branch management and repository hygiene practices to reduce accumulated vulnerabilities and control the growth of security findings.
• Produce regular vulnerability management reports and progress metrics for the CISO and senior leadership, including accurate weekly reporting.
• During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within the DevOps team.
• Coordinate remediation activities across engineering teams and translate technical findings into clear, actionable information for non-technical stakeholders.

Qualifications

• Approximately 8+ years of experience in DevOps or platform engineering, with substantial practical DevSecOps expertise.
• Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.
• Hands-on experience managing vulnerabilities at scale, including aggregation, deduplication, risk-based prioritization, and remediation tracking.
• Strong understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.
• Demonstrated ability to prepare reliable, concise reporting that communicates risk and progress to senior management and non-technical stakeholders.
• Capacity to coordinate cross-team security remediation and to lead technical initiatives during cloud and infrastructure phases.
• Preferred: experience with vulnerability aggregation platforms such as DefectDojo; container and Kubernetes security expertise; knowledge of SBOM, software supply chain security practices (SLSA, Sigstore); familiarity with Azure DevOps or AWS CodePipeline; experience building dashboards or security reporting in Power BI or Datadog.
• Comfortable working in environments that use Java, .NET, Node.js/TypeScript, Ruby, and PHP.
• Opportunity to join and shape a dedicated security team for a high-impact SaaS provider serving public-sector clients across North America.
• Unique TEAL culture that values relationships and respect in a non-corporate atmosphere.
• Agile approach with minimal bureaucracy to help you move quickly and deliver value.
• Outstanding integration trips to various places in Europe.
• Activities to support well-being and health.
• Luxmed Gold Extended medical care and Multisport Plus benefit.