DevSecOps Engineer

Alvys Inc.; United States; On-site; USD 110,000 - 170,000; Full time

Job summary

Alvys Inc. is seeking a DevSecOps Engineer to strengthen our cloud security posture and integrate security into our software delivery lifecycle.

You will own vulnerability management, AI-assisted security testing, and the deployment of security tooling across Azure and related platforms. You will work closely with DevOps, engineering, IT and Security teams to design secure infrastructure, automate compliance, and drive secure practices across the product.

Qualifications

• Fluent in English, spoken and written.
• 3+ years of professional experience in DevOps, cloud infrastructure, platform engineering, or security engineering.
• Hands-on experience with at least one major cloud provider (Azure, AWS, or GCP), including networking, identity and access management, and secrets management.
• Production experience with infrastructure as code, preferably Terraform.
• Experience building and maintaining CI/CD pipelines.
• Working knowledge of containers and Kubernetes.
• Scripting skills in Python, PowerShell, or Bash.
• Understanding of common security risks in cloud and web applications, and how to fix them.
• Ability to explain technical risk clearly to engineers and non-engineers.

Responsibilities

• Design and deliver cloud security architecture improvements, including network isolation and IAM hardening.
• Implement infrastructure as code changes and plan rollout to minimize customer downtime.
• Lead vulnerability management and extend security scanning with AI-assisted testing.
• Oversee penetration testing from scoping to retesting and remediation.
• Build telemetry pipelines and dashboards for AI tooling using OpenTelemetry / Azure Monitor.
• Collaborate with DevOps, engineering, IT & Security to align on secure roadmaps and SOC 2 evidence.

Skills

English proficiency

CI/CD pipelines

Cloud security concepts

Security testing automation

Scripting (Python/PowerShell/Bash)

Tools

Terraform

Kubernetes

GitHub Actions

Azure DevOps

Job description

Join Alvys, an early-stage company transforming the $800B US freight industry. As a DevSecOps Engineer, you'll help protect our platform and the customer data it holds. You'll close cloud security gaps, build security checks into how we ship software, run our penetration testing program, and stand up the infrastructure behind our internal security, IT & AI tools. This role combines hands-on infrastructure work with coordination across DevOps, engineering teams, IT & Security, and outside security vendors.

Industry Insight

Freight companies run their business on Alvys: loads, drivers, carriers, payments, and financial records. As more of the industry moves to modern software, customers expect that data to be protected like any other business-critical system. Security is part of how we earn and keep their trust.

About Alvys

Alvys is building a multi-tenant SaaS platform that powers modern transportation operations. We combine deep industry knowledge with strong technical execution to bring clarity, automation, and reliability to one of the world's most essential industries. Security is a shared responsibility at Alvys, and this role helps every team meet that bar.

Engineering Principles

• Build for Real-World Impact. Our users rely on Alvys to solve real problems, not abstract ones. Every security fix should reduce real risk to our platform and the people moving freight every day, not just clear a scanner finding.
• Extreme Ownership and Empowerment. Ownership extends beyond building. It means being accountable for quality, reliability, and customer impact. If it's in production, it's yours: bugs, uptime, and results.
• Technology Debt is Strategic, Not Accidental. Technical debt is a strategic choice, not an oversight. We incur it deliberately when it unlocks speed, learning, or market advantage. Our architecture remains clean, maintainable, and scalable as we grow.
• Simplicity Scales; Complexity Costs. Logistics is inherently complex, but our technology shouldn't be. We prioritize simplicity in our architecture, leveraging modularity and well-defined service boundaries to reduce cognitive load.
• Radical Transparency. We democratize data and make it accessible across all functions to drive alignment and decision-making. Transparency also means feedback. We systematize constructive feedback loops to ensure growth.
• Move Fast, Learn Fast. Speed is our advantage, but we move fast intentionally. We bias for action, assume positive intent, and treat every mistake as a learning opportunity.
• Own the Outcome. Every engineer owns outcomes, not tickets. We take responsibility end-to-end, identifying problems, delivering solutions, and ensuring they last.
• Partner, Don't Gatekeep. Security works best when it's built with the teams who own the systems. We share context with DevOps and engineering teams, explain the risk behind each ask, and make the secure path the easy one.
• Pragmatism Over Purism. Perfect security doesn't exist, but reduced risk does. We choose fixes that scale, are maintainable, and address real threats, not theoretical ones.
• People Over Heroics. We don't reward burnout or always-on behavior. Sustainability is a feature, not a luxury. If someone needs to slow down, unplug, or take care of life outside work, that's expected.

Responsibilities

Cloud security architecture

• Design and deliver infrastructure changes that strengthen our cloud security posture, including network isolation and identity-based access.
• Make these changes through infrastructure as code, plan rollouts that avoid customer downtime, and work with service owners to update the applications that depend on them.
• Build secure defaults into our infrastructure modules so new resources start out compliant.

Vulnerability management and pipeline security

• Help run our vulnerability management program, driving remediation within defined SLAs.
• Extend our existing security scanning with AI-assisted security testing, such as automated security code review and AI-driven penetration testing.
• Tune and improve the automation we already use to process security findings.

Penetration testing

• Manage our third-party penetration tests from start to finish: scoping and targeting, test environments and accounts, vendor coordination, findings intake, and retesting.
• Help mature our internal, AI-assisted penetration testing tool into a dependable part of the security program, including deployment and scheduled runs.

Infrastructure for security, IT, and AI tooling

• Deploy and operate internal applications in Azure, with identity, secrets, networking, and backups set up correctly from day one.
• Build telemetry pipelines (OpenTelemetry into Azure Monitor) for our AI and internal tools, with dashboards and alerts that surface anomalous activity.

Working with others

• Partner with DevOps, engineering teams, and IT & Security to plan and prioritize work.
• Write clear runbooks and documentation, and produce evidence for our SOC 2 program.
• Infrastructure as code: Terraform
• CI/CD: GitHub Actions and Azure DevOps pipelines
• AI tooling: Cursor, Claude, Claude Platform (managed agents), Grokbot
• Application code: .NET/C#, TypeScript, Angular, React

Minimum Qualifications

• Fluent in English, spoken and written.
• 3+ years of professional experience in DevOps, cloud infrastructure, platform engineering, or security engineering.
• Hands-on experience with at least one major cloud provider (Azure, AWS, or GCP), including networking, identity and access management, and secrets management.
• Production experience with infrastructure as code, preferably Terraform.
• Experience building and maintaining CI/CD pipelines.
• Working knowledge of containers and Kubernetes.
• Scripting skills in Python, PowerShell, or Bash.
• Understanding of common security risks in cloud and web applications, and how to fix them.
• Ability to explain technical risk clearly to engineers and non-engineers.

Preferred Qualifications

• Experience with Azure specifically, including private endpoints, VNet integration, and Entra ID managed identities.
• Experience with application security testing (SCA, SAST, DAST), and interest in applying AI to security testing.
• Experience coordinating penetration tests or working with external security firms.
• Experience with OpenTelemetry, Azure Monitor, or similar observability tools, including writing alert queries (KQL is a plus).
• Familiarity with SOC 2, ISO 27001, or CIS Benchmarks.
• Interest in AI tooling and how to deploy and monitor it safely.
• Security certifications such as AZ-500, Security+, or similar are a plus.
• Background in logistics or transportation is a bonus.

Alvys is an equal opportunity employer and as such, we do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or any other characteristic protected by applicable laws.

We are dedicated to growing a diverse team of highly talented people. We’re dedicated to building a workplace where we give each other the strategies, support, and space we each need to thrive—believing in and bringing out the best of everyone.

If you require any accommodations during the recruitment process, whether it be alternate forms of material, accessible meeting rooms, etc., please let us know and we will work with you to meet your needs.

For information about Alvys's privacy practices, see our Privacy Policy.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in Alvys’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.