DevSecOps Engineer

Divergent; Torrance (CA); Hybrid; USD 116,000 - 181,000; Full time

Job summary

Divergent in Torrance, CA is hiring a DevSecOps Engineer to embed security across the software delivery lifecycle. You will own hardened CI/CD pipelines, policy‑as‑code guardrails, reproducible cloud infrastructure, and vulnerability triage to enable fast, secure delivery.

Work with software, platform, and IT teams to reduce risk without slowing velocity. You will design and maintain secure pipelines, manage Azure/AWS infrastructure, and drive vulnerability remediation with engineering

Qualifications

• U.S. Person required per ITAR (22 CFR §120.62).
• 5–10 years in DevOps, platform, SRE, security, or software engineering.
• Bachelor's degree in CS, IS, cybersecurity, engineering, or related field.
• Production experience with Azure or AWS (IAM, networking, logging).
• Hands‑on with modern CI/CD systems (GitHub Actions, GitLab CI, Azure Pipelines, Jenkins).
• Proficiency with infrastructure as code (Terraform, Bicep, CloudFormation, Pulumi).
• Working knowledge of containers and orchestration (Docker, Kubernetes).
• Scripting in Python, Go, Bash, or PowerShell for tooling.
• Experience with security tooling (Black Duck, Rapid7) — SAST, SCA, secrets scanning.
• Security concepts: least privilege, network segmentation, key management, OAuth/OIDC/SAML, OWASP Top 10.
• Git-based workflows, code review, and branch protection.
• Clear written and verbal communication.

Responsibilities

• Design, build, and maintain CI/CD pipelines with automated security gates and actionable findings.
• Provision and manage cloud infrastructure as code across Azure and AWS with policy checks.
• Harden container and Kubernetes workloads, including base image lifecycle and least-privilege identity.
• Own secrets management and pipeline authentication to remove long‑lived keys.
• Triage vulnerability findings across code, dependencies, containers, and cloud posture.
• Build software supply chain controls: dependencies, signatures, SBOM generation.
• Instrument delivery environments with detections, dashboards, and alerts for security observability.
• Automate cloud security posture assessment and remediation across accounts.
• Support frameworks mapping and automated audit evidence generation.
• Raise security baseline via reusable templates, golden paths, code reviews, mentoring.

Skills

CI/CD security

Cloud security

Git workflows

Python scripting

Education

Bachelor's degree in CS/IS/Cybersecurity/Engineering

Tools

Terraform

Azure

AWS

Kubernetes

GitHub Actions

Jenkins

Open Policy Agent

Hashi Vault

Snyk/Black Duck

Job description

Divergent is building the new industrial age. Every day, our teams design, manufacture, and assemble advanced systems for some of the world’s most demanding industries. Our integrated engineering and manufacturing platform transforms complex designs into production-ready solutions, helping customers move faster, build smarter, and deliver critical systems when they matter most. Divergent is a qualified Tier 1 supplier to global automotive OEMs and supports leading U.S. aerospace and defense companies.

Join us and help push the boundaries of what can be built.

Purpose

We are seeking a DevSecOps Engineer to embed security into every stage of the software delivery lifecycle, from the first commit through production operation. Divergent Technologies Inc. builds and operates a digital manufacturing platform in which software, hardware, and physical production are tightly coupled, which means the pipelines that ship our code warrant the same protection as the code itself. In this role you will own the automation that makes secure delivery the default rather than the exception: hardened CI/CD pipelines, policy-as-code guardrails, reproducibly provisioned cloud infrastructure, and vulnerability findings that reach the responsible engineer with enough context to act on. You will partner with software, platform, and IT teams to reduce risk without slowing delivery, treating security controls as engineering problems to be solved with tooling rather than checklists to be enforced after the fact.

The Role

• Design, build, and maintain CI/CD pipelines with automated security gates — static analysis, software composition analysis, secrets detection, container image scanning, and infrastructure-as-code policy checks — that fail fast and produce actionable findings.
• Provision and manage cloud infrastructure as code across Azure and AWS environments and enforce configuration standards through policy-as-code rather than manual review.
• Harden container and Kubernetes workloads, including base image lifecycle, admission control, runtime policy, network segmentation, and least-privilege workload identity.
• Own secrets management and pipeline authentication — vaulted credentials, short-lived tokens, and federated identity — and drive the elimination of long-lived static keys.
• Triage and prioritize vulnerability findings across source code, third‑party dependencies, container images, and cloud posture; partner with engineering owners to drive remediation to closure against defined service levels.
• Build and maintain software supply chain controls, including dependency and lockfile hygiene, artifact signing and provenance, and software bill of materials generation and distribution.
• Instrument delivery and runtime environments for security observability by defining detections, dashboards, and alerting, and participate in response for pipeline and infrastructure incidents.
• Automate cloud security posture assessment and remediation across accounts and subscriptions, covering identity, network, logging, and encryption baselines.
• Support control mapping and audit evidence collection for applicable frameworks, favoring automated evidence generation over manual attestation.
• Raise the security baseline of other engineers through reusable pipeline templates, documented golden paths, code review, and hands‑on mentoring.

teams to reduce risk without slowing delivery, treating security controls as engineering problems to be solved with tooling rather than checklists to be enforced after the fact.

The Role

• Design, build, and maintain CI/CD pipelines with automated security gates — static analysis, software composition analysis, secrets detection, container image scanning, and infrastructure-as-code policy checks — that fail fast and produce actionable findings.
• Provision and manage cloud infrastructure as code across Azure and AWS environments and enforce configuration standards through policy-as-code rather than manual review.
• Harden container and Kubernetes workloads, including base image lifecycle, admission control, runtime policy, network segmentation, and least‑privilege workload identity.
• Own secrets management and pipeline authentication — vaulted credentials, short‑lived tokens, and federated identity — and drive the elimination of long‑lived static keys.
• Triage and prioritize vulnerability findings across source code, third‑party dependencies, container images, and cloud posture; partner with engineering owners to drive remediation to closure against defined service levels.
• Build and maintain software supply chain controls, including dependency and lockfile hygiene, artifact signing and provenance, and software bill of materials generation and distribution.
• Instrument delivery and runtime environments for security observability by defining detections, dashboards, and alerting, and participate in response for pipeline and infrastructure incidents.
• Automate cloud security posture assessment and remediation across accounts and subscriptions, covering identity, network, logging, and encryption baselines.
• Support control mapping and audit evidence collection for applicable frameworks, favoring automated evidence generation over manual attestation.
• Raise the security baseline of other engineers through reusable pipeline templates, documented golden paths, code review, and hands‑on mentoring.

Basic Qualifications

• Must be a U.S. Person as defined by the International Traffic in Arms Regulations (22 CFR §120.62) — a U.S. citizen, lawful permanent resident, or other protected individual.
• 5–10 years of professional experience in DevOps, platform, site reliability, security, or software engineering, including at least 3 years with direct responsibility for securing CI/CD pipelines or cloud infrastructure.
• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Engineering, or a related technical field, or equivalent demonstrated experience.
• Production experience with at least one major cloud provider (Azure or AWS), including its identity and access management, networking, and logging services.
• Hands‑on experience building and maintaining pipelines in a modern CI/CD system such as GitHub Actions, GitLab CI, Azure Pipelines, or Jenkins.
• Proficiency with infrastructure as code (Terraform, Bicep, CloudFormation, or Pulumi), with changes managed through version control and peer review.
• Working knowledge of containers and orchestration (Docker and Kubernetes), including image hardening and cluster access control.
• Automation and scripting ability in Python, Go, Bash, or PowerShell sufficient to build internal tooling and integrate vendor APIs, not solely to configure existing tools.
• Practical experience integrating and operating application security tooling (Blackduck or Rapid7) — SAST, software composition analysis, secrets scanning, and image scanning — and triaging its output.
• Solid grasp of core security concepts, including least privilege, network segmentation, key management, authentication and authorization protocols (OAuth 2.0, OIDC, SAML), and common vulnerability classes such as the OWASP Top 10.
• Experience with Git‑based team workflows, code review, and branch protection.
• Clear written and verbal communication, with the ability to explain security risk and engineering tradeoffs to both technical and non‑technical audiences.

Preferred Qualifications

• Experience in an export‑controlled or otherwise regulated environment (ITAR/EAR, CMMC, NIST SP 800‑171), or in aerospace, automotive, or advanced manufacturing.
• Exposure to manufacturing or operational technology systems, including securing build, test, or production‑floor systems that cannot tolerate unplanned downtime.
• Software supply chain security experience with SBOM tooling (Syft, CycloneDX, SPDX), artifact signing (Sigstore/cosign), SLSA provenance, or platforms such as Black Duck, Snyk, or Dependency‑Track.
• Policy‑as‑code experience with Open Policy Agent/Rego, Kyverno, Conftest, Checkov, or cloud‑native policy engines.
• Kubernetes security depth, including admission controllers, service mesh mTLS, and runtime detection tooling such as Falco or Tetragon.
• Secrets platform experience with HashiCorp Vault, Azure Key Vault, or AWS Secrets Manager, including dynamically issued credentials.
• Detection engineering or SIEM experience (Microsoft Sentinel, Splunk, or Elastic), including log pipeline design and tuning.
• Threat modeling experience and familiarity with the MITRE ATT&CK framework.
• Observability tooling experience with Prometheus, Grafana, OpenTelemetry, or Datadog.
• Relevant certifications such as CISSP, CCSP, CKS, GIAC (GCSA, GCLD, GWAPT), or a cloud provider security specialty.
• Contributions to internal developer platforms, golden‑path templates, or open‑source security tooling.
• This is a hybrid on‑site role located at our Torrance, CA headquarters.
• Standard schedule is Monday through Friday during core business hours, with flexibility required for occasional after‑hours deployment windows, maintenance, and security incident response.
• Participation in a shared on‑call rotation for pipeline and infrastructure incidents.
• Work is performed primarily in office and laboratory settings, with periodic time on the manufacturing floor where personal protective equipment is required.
• Prolonged periods of sitting and working at a computer.
• Occasional lifting and moving of equipment weighing up to 25 pounds.
• The role requires access to export‑controlled technical data; continued access is contingent on maintaining U.S. Person status.

Compensation

At Divergent, our pay range is based on the level of the job. For this role, we will consider candidates at levels S04 - S05 as evaluated through our interview process.

• INT S04/ Specialist 4: $115,843 - $156,729
• INT S05/ Senior Specialist: $133,766 - $180,977

Pay Range

$115,843 - $180,977 USD

What We Offer:

• Holistic Compensation Package: Enjoy a world‑class compensation package that includes a competitive salary, equity plan, and discretionary results‑based incentive bonus opportunities, ensuring you're truly valued for your contributions.
• Wellness and Time Off: Embrace a healthy lifestyle with paid vacation, sick time, and company holidays, including a year‑end shutdown to recharge. We support growing families with paid parental leave, recognizing the importance of bonding time.
• Comprehensive Health and Wellness: Prioritize your well‑being with our comprehensive health and wellness benefits, offering both HMO and Premium PPO options. Additionally, benefit from company‑sponsored life insurance and short and long‑term disability coverage for peace of mind.
• Investment in Growth: We're committed to your professional development. Take advantage of reimbursement opportunities for learning and development initiatives, empowering you to continuously expand your skill set and reach peak performance.
• Collaborative and High-Performing Environment: Join our collaborative, dynamic, and high‑performing team within a fast‑paced, mission‑driven company. Together, we're disrupting the traditional manufacturing industry, fostering innovation, and integrating people and technology to reduce our footprint.

Equal Employment Opportunity
Divergent is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or veteran status, or any other applicable state or federal protected characteristic. Divergent provides affirmative action in employment for qualified Individuals with Disabilities and Protected Veterans in compliance with Section 503 of the Rehabilitation Act and the Vietnam Era Veterans’ Readjustment Assistance Act.

E-Verify: Right to Work
Our company participates in E-Verify . E-Verify is a program that electronically confirms a candidate’s eligibility to work in the United States after completing the Employment Eligibility Verification (Form I-9). The information provided on the Form I-9 is compared to the records contained in the Social Security Administration and Department of Homeland Security (DHS) databases. This helps employers verify the identity and employment eligibility of newly hired employees.
Eligibility to Work Poster (English) | Eligibility to Work Poster (Spanish)

Los Angeles Fair Chance Initiative for Hiring Ordinance (FCIHO)
Pursuant to the Los Angeles Fair Chance Initiative for Hiring Ordinance (FCIHO), we will consider for employment qualified applicants with arrest and conviction records.

No agencies, no solicitations, and no calls please.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self‑identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Divergent’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service‑connected disability.

A "recently separated veteran" means any veteran during the three‑year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.