Senior Dev SecOps Engineer

NextEra Energy, Inc.; Saint Paul (MN); On-site; USD 110,000 - 164,000; Full time

Job summary

NextEra Energy, Inc. seeks a Senior DevSecOps Engineer to embed security across the software development lifecycle and fortify cloud platforms, pipelines, and the software supply chain.

You will partner with software, cloud, governance, and cybersecurity teams to implement secure-by-default patterns and measurable controls while enabling AI-assisted development. The role emphasizes threat modeling, secure design reviews, and collaboration across engineering and risk teams to reduce risk without

Qualifications

• Bachelors or equivalent practical experience in CS/Cybersecurity/Engineering/IT.
• 7+ years in DevSecOps, security, or related technical disciplines.
• Experience designing and securing enterprise CI/CD pipelines.
• Experience with SAST/SCA/DAST, secret scanning, and IaC scanning.
• Knowledge of SBOMs, software provenance, and SLSA practices.
• Hands-on cloud security across AWS/GCP.
• Experience with Terraform and policy-as-code tools.
• Strong IAM, least privilege, and secure logging concepts.
• Experience governing AI coding assistants and AI-generated code.
• Ability to collaborate across multiple teams and communicate clearly.

Responsibilities

• Secure software delivery and CI/CD pipelines with automated security gates.
• Configure risk-based security controls to minimize false positives and friction.
• Lead threat modeling and secure design reviews early in the lifecycle.
• Promote architectural security improvements and recurrence prevention.
• Develop reusable pipeline templates and secure-by-default patterns.
• Establish security standards for AI coding assistants and agentic tools.
• Implement least-agency permissions and code provenance controls.
• Evaluate secure model/context protocol integrations.
• Ensure IAM, network boundaries, centralized logging across cloud environments.
• Establish software supply chain governance and SBOM practices.
• Monitor tooling and processes; drive measurable security outcomes.
• Support audits, pen tests with accurate technical evidence.

Skills

Bachelor's degree

7+ years DevSecOps

CI/CD security

SAST/SCA/DAST

SBOMs/software provenance

Cloud security (AWS/GCP)

Infrastructure-as-Code

IAM/least privilege

AI security governance

Cross-functional collaboration

Technical communication

Education

Bachelor's degree in CS/Cybersecurity/Engineering/IT

Tools

Terraform

Open Policy Agent

SCA/SAST tooling

IaC scanning tools

Job description

Requisition ID: 97058

NextEra Analytics offers energy consulting services using industry-leading scientific analysis for planning, siting, forecasting and optimizing all forms of energy projects. Our optimization and analytics platforms integrate open-source technologies to leverage massive, diverse sets of utility operating data. This enables rapid development of operational solutions. Applying expertise in advanced mathematics, data and physical sciences, we solve some of the hardest problems facing the energy industry.

Position Specific Description

We are seeking a high-caliber Senior DevSecOps Engineer to embed security throughout the software development lifecycle and strengthen the security of our cloud platforms, development pipelines, and software supply chain. This role is designed for an experienced security engineer who combines deep technical expertise with a strong understanding of modern software engineering and developer workflows.

You will partner closely with software engineering, cloud, platform, cybersecurity, and governance teams to build scalable security controls that reduce risk without creating unnecessary friction. You will operate with a high degree of autonomy, establishing secure-by-default patterns, influencing system design, and implementing measurable controls across traditional and AI-assisted development environments.

Key Responsibilities & Expectations

• Secure Software Delivery
• Secure CI/CD Pipelines: Build and maintain secure CI/CD pipelines with automated security gates, including static application security testing, software composition analysis, dynamic application security testing, secret scanning, infrastructure-as-code scanning, and container or image scanning.
• Risk-Based Security Controls: Configure and tune security tooling using exploitability and reachability-based prioritization to minimize false positives and reduce unnecessary developer friction.
• Secure Design Influence: Lead threat modeling, security design reviews, and the adoption of secure architecture patterns early in the development lifecycle.
• Root-Cause Remediation: Promote architectural and systemic security improvements that prevent recurring issues rather than relying on short-term or symptom-based fixes.
• Developer Enablement & AI Security
• Developer Guardrails: Develop reusable pipeline templates, hardened base images, security guardrails, and secure-by-default development patterns that shift security left without slowing delivery.
• AI-Assisted Development Security: Establish security standards and governance for AI coding assistants, agentic development tools, and AI-generated code.
• Agentic Security Controls: Implement least-agency permission models, human review requirements, code provenance standards, and controls governing autonomous agent access to tools, data, and environments.
• Secure Tool Integration: Evaluate and secure agent tool integrations, including Model Context Protocol integrations, while ensuring appropriate authentication, authorization, isolation, and oversight.
• Cloud, Platform & Software Supply Chain Security
• Cloud Security Controls: Implement identity and access management, least-privilege access, network boundaries, centralized logging, and secure configuration standards across AWS and GCP environments.
• Software Supply Chain Security: Establish software and AI bills of materials, dependency governance, artifact signing, and software provenance aligned with frameworks such as SLSA.
• Pipeline Hardening: Protect the software delivery pipeline through OIDC-based publishing, OIDC-based publishing, controlled network egress, secure secrets management, and hardened build environments.
• Infrastructure- and Policy-as-Code: Implement infrastructure-as-code and policy-as-code controls that provide consistent enforcement, immutable logging, and automated evidence generation.
• Vulnerability Management & Risk Reduction
• Vulnerability Ownership: Lead vulnerability triage, exploitability-informed risk ranking, remediation service-level objectives, exception management, and recurrence prevention.
• Security Metrics: Define and track meaningful measures such as mean time to remediate, scan coverage, policy compliance, vulnerability recurrence, and developer adoption of security guardrails.
• Continuous Improvement: Use security findings, operational data, and engineering feedback to continuously improve tooling, processes, and preventative controls.
• Measurable Outcomes: Demonstrate risk reduction over time through clear reporting, actionable metrics, and transparent communication with technical and business stakeholders.
• Cybersecurity, Risk & Compliance Partnership
• Cross-Functional Partnership: Collaborate with application security, engineering, cloud, platform, cybersecurity, risk, and compliance teams to integrate security into technical delivery.
• Automated Security Evidence: Feed pipeline evidence, security findings, software inventories, and control results into application security reviews, third-party risk assessments, and compliance activities.
• Assessment Support: Support penetration testing, application assessments, audit requests, and remediation efforts by providing accurate technical evidence and tracking corrective actions.
• Security Translation: Clearly communicate security risks, technical tradeoffs, and remediation priorities to engineering teams, cybersecurity leadership, and business stakeholders.

Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, Information Technology, or equivalent practical experience.
• 7+ years of experience in DevSecOps, application security, cloud security, platform engineering, software engineering, or a related technical discipline.
• Hands-on experience designing and securing enterprise CI/CD pipelines and software development workflows.
• Experience implementing and operating security testing capabilities such as SAST, SCA, DAST, secret scanning, infrastructure-as-code scanning, and container or image scanning.
• Strong knowledge of software supply chain security concepts, including SBOMs, artifact signing, software provenance, dependency governance, and SLSA-aligned practices.
• Hands-on experience implementing cloud security controls across AWS, GCP, or comparable public cloud platforms.
• Experience with infrastructure-as-code and policy-as-code technologies such as Terraform, Open Policy Agent, or comparable toolsets.
• Strong understanding of identity and access management, least privilege, network segmentation, secure logging, secrets management, and cloud-native security architecture.
• Experience assessing or governing AI coding assistants, autonomous development agents, AI-generated code, or agent tool integrations.
• Proven ability to collaborate with software engineering, cybersecurity, risk, compliance, and platform teams in a fast-paced development environment.
• Strong written and verbal communication skills, including the ability to explain complex security risks and technical decisions in clear, outcome-oriented terms.

Job Overview

This position is responsible for managing, monitoring and deploying a highly available, highly scalable production application. The individual will be responsible for one or more environments and/or systems and interface directly with the Development and Operations team on a daily basis for the maintenance, expansion, and documentation of these environments, providing assistance and review of proposed architectures, as needed. This role is responsible for vetting emerging technologies and guides the direction of the teams that support software development.

Job Duties & Responsibilities

• Drives the automation and continuous improvement of the software delivery process
• Manages the continuous integration services maintenance and configuration, ensuring the build environment is meeting the needs of the software developers
• Leads the maintenance and creation of automatic deployment of software builds to the test and production environments, enabling the operations team to easily and consistently deploy new software products
• Monitors system development and maintenance and ensures that staff at all technical levels are informed of the health of our systems
• Evaluates Operation teams processes and automates repetitive and temporary solutions
• Improves the product environment and practices used by the software developers
• Sets up back-up mechanisms for production environments and test disaster recovery mechanisms
• Performs other job-related duties as assigned

Required Qualifications

• High School Grad / GED
• Bachelor's or Equivalent Experience
• Experience: 4+ years

Preferred Qualifications

• None

The estimated base pay for this position is $109,600.00 to $164,400.00 per year. Starting pay will be based on several factors including, but not limited to, experience, qualifications, job-related and industry knowledge and skills and education/training.

NextEra Energy offers a wide range of benefits to support our employees and their eligible family members.

Employee Group: Exempt

Employee Type: Full Time

Job Category: Information Technology

Organization: NextEra Analytics, Inc

Relocation Provided: Yes, if applicable

NextEra Energy is an Equal Opportunity Employer. Qualified applicants are considered for employment without regard to race, color, age, national origin, religion, marital status, sex, sexual orientation, gender identity, gender expression, genetics, disability, protected veteran status or any other basis prohibited by law.

NextEra Energy provides reasonable accommodation in its application and selection process for qualified individuals, including accommodations related to compliance with conditional job offer requirements, consistent with federal, state, and local laws. Supporting medical or religious documentation will be required where applicable and permitted by applicable law. To request a reasonable accommodation, please send an e-mail to [e-mail] , providing your name, telephone number and the best time for us to reach you.

NextEra Energy will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor’s legal duty to furnish information.