Information Security Engineer - DevSecOps

Fisher Investments; Tampa, Northern (FL, KY); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

100% paid medical, dental and vision

50% 401(k) match

20 days PTO + 10 holidays

Family support programs include paid p

Hybrid work from home program

Job summary

Fisher Investments is seeking an Information Security Engineer (DevSecOps) to help secure CI/CD pipelines and cloud workloads across our technology landscape. You will build and operate security services (GitHub Advanced Security, CNAPP), align with standards (NIST/CIS/ISO), and drive automation through IaC tooling.

You will partner with Information Security, Technology, and Governance teams to reduce risk, implement secure coding practices, and contribute to enterprise-wide security posture

Qualifications

• 5+ years of professional experience in technology or information security.
• 2+ years hands-on DevSecOps engineering with security automation in software delivery and cloud environments.
• Experience with Azure or AWS cloud infrastructure and containerized workloads.
• Knowledge of CNAPP products and cloud security posture management (CSPM).
• Familiarity with IaC and policy-as-code management of cloud security policies.
• 1+ years with GitHub Advanced Security, GitHub Actions, Terraform, or comparable tools.
• Experience with secure coding in C#, Java, Python, or comparable languages.
• Bachelor's Degree in Computer Science or Technology or equivalent experience.

Responsibilities

• Develop and manage the configuration, maintenance, and operations of DevSecOps-related security services (e.g., GitHub Advanced Security, CNAPP).
• Secure CI/CD platforms and implement pipeline security practices, controls, and vulnerability response with various teams.
• Assess cloud security posture and correlate findings from source code to cloud workloads; propose risk remedies.
• Develop secure coding, cloud security, and architecture standards per NIST, CIS, ISO, and other standards.
• Standardize processes and automate security controls via coding and scripting.
• Support CNAPP configuration as code and policy-as-code in CI/CD pipelines (Terraform/IaC).
• Create architectural diagrams and implementation plans for initiatives.

Skills

DevSecOps

Security automation

Cloud security

CSPM

IaC

NIST/CIS/ISO

Python/PowerShell

Education

Bachelor's Degree in Computer Science or Technology

Tools

GitHub Actions

Terraform

Kubernetes

CNAPP

Job description

It's an exciting time to be a member of the Fisher Investments Technology Department. We're investing in the future of our firm's technology and are building our team to achieve global growth. We are looking for an Information Security Engineer (DevSecOps) to support our Information Security team. If you are looking for an opportunity to make a difference as we develop scalable and strategic solutions to support our global growth, we want to hear from you!

The Opportunity:

The Information Security Engineer DevSecOps will be a part of the team that drives future global growth and scale through strategic solutions and continuous innovation. You will help support our firm's diverse departments by building relationships with partners, while consulting and managing a full range of CI/CD pipeline cyber security controls with technology teams at an Enterprise level. You will contribute to projects that require Information Security DevSecOps experience in application development, release management, and infrastructure as code environments.

The Day-to-Day:

• Develop and manage the configuration, maintenance, and operations of DevSecOps-related security services, including GitHub Advanced Security and CNAPP platforms.
• Frequent interaction with Information Security, Technology, Project, and Governance teams to secure CI/CD platforms and implement pipeline security practices, controls, and vulnerability response.
• Use analytical and technical knowledge to assess cloud security posture, correlate findings from source code to cloud workloads, and propose cyber security risk remedies related to DevSecOps.
• Participate actively in the development of secure coding, cloud security, and architecture standards, using NIST, CIS, ISO, and other international standards.
• Identify areas for improvement proactively and support the DevSecOps effort in standardizing processes and automating security controls through coding and scripting.
• Contribute to the success of the Information Security DevSecOps program by supporting teams in implementing cloud security policies and CNAPP configuration as code, using Terraform or comparable infrastructure as code (IaC) tooling where supported.
• Analyze security controls and make recommendations for changes or improvements, including CNAPP and policy-as-code integration into CI/CD pipelines.
• Develop and manage initiative-level artifacts, including architectural diagrams and implementation plans.

Your Qualifications:

• 5+ years of professional experience in technology or information security.
• 2+ years of hands-on DevSecOps engineering or implementing security automation within software delivery and cloud environments, including:
  • Write, testin, debug, and maintain code or scripts in PowerShell, Python, C#, Java, or comparable languages.
  • CI/CD pipeline development, security control integration, and CI/CD platform security.
  • Azure or AWS cloud infrastructure and containerized workloads.
  • CNAPP products and cloud security posture management (CSPM), including operation or evaluation of multiple products.
  • Source-to-cloud findings correlation, vulnerability assessment, and remediation.
  • Infrastructure as code (IaC) and policy-as-code management of cloud security policies and CNAPP configuration, with CI/CD integration.
• 1 or more years of experience in related technologies and practices, including:
  • GitHub Advanced Security, GitHub Actions, Terraform, or comparable tools.
  • Application development and secure coding in C#, Java, Python, or comparable languages.
  • Kubernetes security, cloud workload protection, and cloud infrastructure entitlement management.
  • Policy frameworks such as Open Policy Agent (OPA)/Rego or native CNAPP policy languages.
  • Apply NIST, CIS, ISO, or comparable frameworks to technical security controls.
  • Bachelor's Degree in Computer Science or Technology or equivalent experience.

Why Fisher Investments:

We work for a bigger purpose: bettering the investment universe. We take great pride in our inclusive culture, our learning and development framework customized for every employee, and our Great Place to Work Certification. It's the people that make the Fisher purpose possible, and we invest in them by offering exceptional benefits like:

• 100% paid medical, dental and vision premiums for you and your qualifying dependents
• A 50% 401(k) match, up to the IRS maximum
• 20 days of PTO, plus 10 paid holidays
• Family Support programs including 8 week Paid Primary Caregiver Leave, $10,000 fertility, family forming, and hormonal health assistance, and back-up child, adult, and elder care
• This is an in-office role. Based on your role, tenure, and performance eligibility you may have the opportunity to participate in our hybrid work from home program. This program is subject to change.

FISHER INVESTMENTS IS AN EQUAL OPPORTUNITY EMPLOYER