DevSecOps & Application Security Engineer

State Street; Quincy (MA); On-site; USD 100,500 - 167,500; Full time

Job summary

State Street is seeking an experienced security professional to lead AppSec and DevSecOps within a large, multi-application environment. You will drive secure software development lifecycle adoption, automate security processes in CI/CD pipelines, and partner with engineering to embed DevSecOps into development practices.

You will work with SAST/DAST, SCA and container security, and contribute to governance, reporting, and tooling across hybrid cloud environments.

Qualifications

• Bachelor’s degree in IT, CS or related field; 6+ years of relevant experience.
• Experience in SDLC, CI/CD, DevSecOps best practices, and application security tooling.
• Experience partnering with Dev community to influence adoption of app security practices and tooling.
• Security+ or CISSP certification.
• Proficiency in Java, .NET, Python; knowledge of at least one other language like Java or Node.js.

Responsibilities

• Help build DevSecOps and AppSec strategy to integrate cybersecurity into agile practices.
• Partner with Engineering leads to create, implement, and apply DevSecOps and AppSec principles and processes.
• Assist application teams with onboarding to security tools; work with vendors to troubleshoot integrations.
• Triage SAST and SCA vulnerabilities and coordinate remediation with teams.
• Deliver reporting via dashboards and metrics; develop and maintain security documentation.
• Assist in audit processes and provide documentation to close findings.
• Continuously improve DevSecOps and AppSec processes and tools.
• Deliver tasks based on project objectives and support projects to completion.

Skills

Java

.NET

Python

Node.js

Education

Bachelor’s degree in IT/CS

Security+ or CISSP

Tools

CI/CD tooling

Ansible

Terraform

Kubernetes

Job description

State Street is seeking an experienced security professional to lead AppSec and DevSecOps within a large, multi-application environment. You will drive secure software development lifecycle adoption, automate security processes in CI/CD pipelines, and partner with engineering to embed DevSecOps into development practices.

You will work with SAST/DAST, SCA and container security, and contribute to governance, reporting, and tooling across hybrid cloud environments.