DevSecOps SCA Engineer 1212260

BMA Group Panama; San Juan (PR); On-site; USD 110,000 - 170,000; Full time

Job summary

[Your Company Name] is seeking a DevSecOps SCA Engineer to integrate security into our DevOps processes and leverage SCA tools to ensure secure software delivery. The role emphasizes open-source management, automation, and cross-functional collaboration to uphold compliance and secure engineering practices.

You will build secure CI/CD pipelines, perform regular SCA scans, and mentor teams on secure coding and risk mitigation in a forward-thinking environment.

Qualifications

• Bachelor’s degree in CS/IT/Cybersecurity or equivalent practical experience.
• Experience with DevOps tools like Jenkins, Git, Azure DevOps.
• Proven expertise in SCA tools: Sonatype Nexus, JFrog X-Ray, Snyk, WhiteSource.
• Proficiency in Python, Bash or Groovy.
• Strong knowledge of open-source ecosystems and licensing models.
• Understanding of secure software development lifecycle and containerization.

Responsibilities

• Embed security into DevOps workflows via CI/CD pipelines.
• Monitor open-source components for vulnerabilities and compliance.
• Develop automation to orchestrate security testing in pipelines.
• Identify vulnerabilities and collaborate with teams to remediate.
• Collaborate with development, operations, and security teams.
• Support audits for GDPR, HIPAA and related standards with SCA data.
• Stay updated on DevSecOps trends and practices.
• Educate teams on secure coding and risk mitigation.

Skills

Jenkins

Git

Azure DevOps

SCA Tools

Python

Bash

Groovy

Kubernetes

Open Source

Education

Bachelor's in CS/IT/Cybersecurity

Tools

Sonatype Nexus

JFrog X-Ray

Snyk

WhiteSource

Job description

Job Description: DevSecOps SCA Engineer

Overview

We are seeking a dedicated DevSecOps SCA (Software Composition Analysis) Engineer to join our forward-thinking and dynamic team. This role involves integrating security practices within DevOps processes and leveraging tools to analyze software components, ensuring that our applications and systems remain resilient, secure, and reliable. If you are passionate about cybersecurity, open source, and automation, we welcome you to an innovative environment where your contributions will make a meaningful impact within our technology landscape.

At [Your Company Name], we are committed to fostering an inclusive workplace that values diversity in all forms. We strongly encourage candidates from all backgrounds, communities, identities, and experiences to apply.

Responsibilities

• Embed Security into DevOps Workflows: Implement and maintain Software Composition Analysis (SCA) as part of the CI/CD pipeline to ensure secure software delivery.
• Open Source Management: Monitor open-source components, libraries, and dependencies for vulnerabilities and compliance violations.
• Build and Scale Automation: Develop, implement, and enhance automation tools and scripts to orchestrate end-to-end security testing within DevOps pipelines.
• Vulnerability Identification and Remediation: Proactively identify security vulnerabilities, provide actionable recommendations, and collaborate with development teams to resolve identified issues.
• Collaboration Across Teams: Partner with development, operations, and security teams to ensure proper security controls and practices are followed throughout the software development lifecycle.
• Compliance Audits: Support compliance requirements such as GDPR, HIPAA, or other relevant standards by providing necessary documentation and audit-ready insights from SCA tools.
• Research and Innovation: Stay updated on the latest tools, trends, and developments within DevOps, security, and software engineering industries.
• Training and Enablement: Educate and mentor teams on secure coding practices, vulnerabilities management, and open-source risk mitigation principles.

Qualifications

Required:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
• Strong experience with DevOps tools such as Jenkins, Git, Azure DevOps, or equivalent.
• Proven expertise in Software Composition Analysis (SCA) tools like Sonatype Nexus, JFrog X-Ray, Snyk, or WhiteSource.
• Proficiency in programming languages such as Python, Bash, or Groovy.
• Deep knowledge of open-source software ecosystems and related licensing models.
• Solid understanding of secure application development principles and lifecycle management.
• Familiarity with containerization platforms, such as Docker and Kubernetes.

Preferred:

• Certifications such as Certified DevSecOps Professional (CDOP), AWS Certified Security - Specialty, or equivalent credentials.
• Experience working in Agile/Scrum environments.
• Practical knowledge of Cybersecurity standards such as OWASP, ISO 27001, and NIST.
• A keen eye for detail with the ability to detect, assess, and evaluate risk within complex software environments.

Day-to-Day

• Conduct regular SCA scans and share meaningful insights with stakeholders to prioritize security work.
• Build and maintain secure CI/CD pipelines, ensuring they are resilient, automated, and aligned with best practices.
• Troubleshoot and resolve issues stemming from security vulnerabilities during development and deployment cycles.
• Research and validate new tools, technologies, or practices to enhance the organization's overall security posture.
• Actively participate in team meetings, providing technical security updates and actionable plans to mitigate risk.
• Collaborate with cross-functional teams to foster a culture of security-first thinking while accelerating delivery timelines.

Join us as we cultivate a culture built on innovation, inclusivity, and collaboration, where your voice matters, and your expertise shapes safer software solutions for tomorrow.

[Your Company Name] is an equal-opportunity employer. We are committed to building an environment where diversity, equality, and inclusion are celebrated, and everyone has an equal chance to thrive.