DevSecOps Engineer — Build Secure, Fast CI/CD Pipelines

Gifthealth Inc; Columbus (OH); On-site; USD 120,000 - 160,000; Full time

Job summary

Gifthealth Inc. is seeking a DevSecOps Engineer to weave security into the software delivery lifecycle. You will collaborate with Software, Platform, DevOps, and Security teams to embed controls in CI/CD, IaC, and container environments, enabling fast delivery without compromising security.

You will guide secure coding practices, perform threat modeling, and help remediate vulnerabilities across applications and APIs, with a focus on scalable automation and reduced alert fatigue.

Qualifications

• Demonstrated hands-on DevSecOps experience in modern CI/CD environments.
• Experience securing software delivery across multiple platforms and clouds.
• Familiarity with SAST, SCA, secrets scanning, and IaC security tooling.

Responsibilities

• Integrate security controls into the software development lifecycle.
• Design automated security testing within CI/CD pipelines (SAST, SCA, secrets, container scans).
• Establish secure development standards with engineering teams.
• Evaluate applications and APIs for security weaknesses and enforce secure patterns.
• Partner with Infrastructure and Cloud teams to secure IaC, containers, and deployments.
• Drive security metrics, remediation timelines, and continuous improvement.
• Minimize security friction while maintaining rapid delivery.

Skills

DevSecOps

CI/CD security

Application security

Security automation

Threat modeling

SAST

SCA

Secrets management

Tools

GitHub Advanced Security/CodeQL

Dependabot

Terraform

Kubernetes

AWS/GCP/Azure

Render.com/Heroku deployment

CI/CD tooling

Job description

Gifthealth Inc. is seeking a DevSecOps Engineer to weave security into the software delivery lifecycle. You will collaborate with Software, Platform, DevOps, and Security teams to embed controls in CI/CD, IaC, and container environments, enabling fast delivery without compromising security.

You will guide secure coding practices, perform threat modeling, and help remediate vulnerabilities across applications and APIs, with a focus on scalable automation and reduced alert fatigue.