DevSecOps Engineer - Virta Health

OpenTalent; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

Virta Health is seeking a DevSecOps Engineer to strengthen application security and embedding security into the development lifecycle across the platform. You will collaborate with security and engineering teams to mature security controls in GCP and Kubernetes, while building automated tooling for vulnerability management and compliance.

The role emphasizes designing secure systems, promoting a security-conscious culture, and ensuring robust auditing and incident readiness within a health-tech

Qualifications

• Proven experience securing cloud-native applications and infrastructure.
• Experience integrating security into the software development lifecycle (shift-left).
• Strong understanding of IAM, network security, and policy enforcement.

Responsibilities

• Secure Virta's applications and platform across teams.
• Integrate security into development lifecycles and automate controls.
• Improve security design and governance in GCP and Kubernetes environments.
• Refine IAM strategies with least-privilege access and robust auditing.
• Develop and communicate practical security standards and policies.
• Lead vulnerability management and incident response readiness.
• Promote security awareness across engineering teams.

Skills

Security design

Kubernetes

GCP

IAM

Automation

Vulnerability management

Incident response

Secure SDLC

Cloud security

Tools

Kubernetes

Google Cloud Platform (GCP)

CI/CD tooling

IAM tooling

Job description

Virta Health is pioneering a new standard of care for people to reclaim their lives. We are in the midst of a public health crisis: obesity rates are at an all-time high and over half of US adults have type 2 diabetes or prediabetes, and despite billions spent on new treatments, outcomes are largely worse. Virta reverses these diseases and delivers life‑changing results by pairing individualized nutrition with ongoing care from a clinical support team. We have raised over $350 million from top-tier investors, and partner with the largest health plans, employers, and government organizations to help their employees and members restore their health and take back their lives.

As we rapidly scale our impact, we're seeking a passionate DevSecOps engineer to help build and mature our application security program. Working closely with our security lead, you'll implement best practices and help embed security principles across the org. If you thrive on building secure systems, automation, fostering a security‑conscious culture, and making a tangible difference in protecting sensitive health information, this role is for you.

Responsibilities

As a DevSecOps Engineer, you will help secure Virta's applications and platform, directly contributing to the trust our members and partners place in us. You'll collaborate across teams to ensure security is a seamless part of our development lifecycle.

• Improve Security Design: Help assess our current security controls within GCP and Kubernetes, identify areas for improvement, and contribute to the maturation of our security posture from good to great.
• Champion Secure Development: Partner closely with Engineering, Product, and Platform teams to integrate security best practices early and often ("shift-left") into the software development lifecycle.
• Build and Automate: Design, implement, and manage security tooling and automation to streamline vulnerability detection, remediation, and compliance verification. Replace manual processes with efficient, automated solutions.
• Refine Access Control: Evolve our identity and access management (IAM) strategy, ensuring least-privilege access and robust auditing capabilities across our systems.
• Strengthen Network Security: Continuously improve our network security architecture, policies, and controls within our cloud environment.
• Develop Clear Standards: Establish, document, and communicate practical security policies, standards, and guidelines for engineering teams.
• Support Security Initiatives: Drive vulnerability management efforts and enhance our incident response preparedness, ensuring we are ready to handle potential threats effectively.
• Cultivate Security Awareness: Act as a security evangelist, promoting security awareness and best practices throughout the engineering organization.

90 Day Plan