Remote DevSecOps Engineer — Cloud-Native Security

Creandum; Denver, San Francisco (CO, CA); Hybrid; USD 179,000 - 188,000; Full time

Job summary

Virta Health is seeking a DevSecOps Engineer to mature our application security program. You’ll secure cloud-native apps in GCP/Kubernetes, advance IAM controls, and automate vulnerability management while collaborating across Engineering, Product, and Platform teams.

You will help embed security into the SDLC, build security tooling, and foster a culture of security awareness across a growing organization with Denver and San Francisco offices.

Qualifications

• Understanding and practical experience securing cloud-native apps and infra, esp. Kubernetes.
• GCP experience strongly preferred.
• Strong networking concepts, IAM, encryption, and OWASP Top 10 familiarity.
• Excellent communication to explain security concepts across teams.
• Hands-on security experience: SAST, DAST, IAST; threat modeling a plus.
• IaC tooling with Terraform; Go and/or Python development experience.

Responsibilities

• Secure Virta's applications and platform within gCloud/Kubernetes environments.
• Collaborate with Engineering, Product, and Platform teams to shift security left in SDLC.
• Design, implement, and manage security tooling and automation for vulnerability detection and remediation.
• Evolve IAM RBAC, ensure least-privilege access and robust auditing.
• Strengthen network security architecture and cloud policy controls.
• Establish and communicate practical security policies and guidelines for engineering.
• Drive vulnerability management efforts and improve incident response readiness.
• Promote security awareness across the engineering organization.

Skills

Cloud Security

Kubernetes

GCP

IAM

Encryption

OWASP Top 10

Communication

Secure Coding

Vulnerability Management

SAST/DAST/IAST

Terraform

Go

Python

Experience 5-7 yrs

Startup Experience

Tools

Terraform

Job description

Virta Health is seeking a DevSecOps Engineer to mature our application security program. You’ll secure cloud-native apps in GCP/Kubernetes, advance IAM controls, and automate vulnerability management while collaborating across Engineering, Product, and Platform teams.

You will help embed security into the SDLC, build security tooling, and foster a culture of security awareness across a growing organization with Denver and San Francisco offices.