Security QA (DevSecOps)

Groupe Kardol; Jersey City (NJ); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Groupe Kardol in New Jersey is seeking a Security QA to join a hybrid team. You will integrate security testing into CI/CD, balance quality engineering, and collaborate with engineering, platform, and product teams to reduce risk and accelerate secure releases.

The role emphasizes building scalable automation across web, API, and backend services, enforcing OWASP practices, and driving vulnerability management, incident response, and infrastructure hardening.

Qualifications

• Experience integrating security testing into CI/CD pipelines.
• Strong knowledge of OWASP principles.
• Ability to design scalable automation frameworks.
• Experience with cloud security and infrastructure hardening.

Responsibilities

• Identify, triage, and remediate vulnerabilities across applications and cloud.
• Integrate security testing into CI/CD pipelines.
• Monitor pipelines for vulnerabilities and misconfigurations.
• Drive patching, remediation, and infrastructure hardening.
• Collaborate on incident response and root cause analysis.
• Develop test automation for web, API, and backend systems.

Skills

Security testing

DevSecOps

Quality engineering

Automation

Tools

SAST

DAST

SCA

Container scanning

OWASP

IAM

Job description

Security QA

Hybrid in New Jersey

Role Overview

This role sits at the intersection of application security, DevSecOps, and quality engineering. You’ll work closely with engineering, platform, and product teams to identify risks early, strengthen release confidence, and build scalable automation solutions across applications and services.

Key Responsibilities

• Security Engineering & Vulnerability Management
• Identify, triage, and remediate vulnerabilities across applications, cloud, and infrastructure
• Integrate security testing into CI/CD pipelines (SAST, DAST, SCA, container scanning)
• Detect and resolve cloud misconfigurations and security risks
• Enforce secure coding practices aligned with OWASP principles (shift-left security)
• Support audit and compliance initiatives (PCI-DSS, internal security reviews)
• Test Automation & Quality Engineering
• Design and maintain scalable automation frameworks for web, API, and backend systems
• Integrate automated testing into CI/CD pipelines for better regression coverage
• Support release validation and production readiness
• Build tools to enhance test execution, reporting, and reliability
• DevSecOps & Platform Security
• Implement secrets management and secure access controls (IAM, least privilege)
• Monitor applications, infrastructure, and pipelines for vulnerabilities
• Drive patching, remediation, and infrastructure hardening
• Collaborate on incident response, debugging, and root cause analysis