Senior DevSecOps Engineer

Bankrate; United States; Hybrid; USD 120,000 - 180,000; Full time

Job summary

Bankrate is seeking a DevSecOps Engineer to own security posture across our platforms. This hybrid/remote role favors East Coast candidates and requires EST hours; you’ll work from New York, NY or Charlotte area offices when on-site.

You will automate security into the development lifecycle, build policy-as-code, and enable fast, secure software delivery with broad ownership and high impact. Collaborate with engineering, product, and security teams to balance speed and risk while documenting

Responsibilities

• Own the SOC 2 Type 2 compliance program: controls, evidence, audit readiness.
• Run our compliance automation platform: integrations, evidence pipelines, control mapping.
• Productize compliance: policy-as-code, automated evidence, guardrails for audits.
• Own cloud security posture and runtime tooling: posture monitoring and scanning.
• Triage findings with SLAs; design automation and alerting for volume.
• Build auto-remediation workflows with AI-assisted pipelines.
• Build and maintain CI/CD security gates: SAST/SCA, secret scanning, SBOM, dependencies, container/IaC scans.
• Encode security controls into infrastructure-as-code and policy-as-code.
• Help move prototypes to production securely and quickly.

Job description

*This role is open to remote or hybrid candidates (East Coast preference), with hybrid being central to our New York, NY or Charlotte area offices. Must be able to work Eastern Standard Time hours.

Platform Engineering builds the foundations our product teams ship on — deployment, infrastructure, and security. We’re hiring a DevSecOps Engineer to be the technical owner of our security posture and a force multiplier for every engineer at the company.This is a build-the-function role, not a ticket‑taking role. You’ll treat security as code, bake it into the development lifecycle, and automate the toil away so teams can ship fastand safely. You’ll have unusually broad ownership and unusually high impact.

What You’ll Do:

• Own the engineering side of our compliance program (SOC 2 Type 2): implementing controls, collecting evidence, and keeping us audit-ready.
• Operate our compliance automation platform — integrations, evidence pipelines, and mapping controls to real implementation.
• Productize compliance: policy-as-code, automated evidence generation, and guardrails so passing audits doesn’t slow product delivery.
• Own cloud security posture management and runtime security tooling: posture monitoring, container and IaC scanning, and runtime coverage across our environment.
• Triage and remediate findings against demanding SLAs, and design the automation and alerting that keeps pace with volume manual effort can’t.
• Build auto‑remediation workflows — including AI‑assisted pipelines — that detect, file, and (where safe) fix findings with minimal human intervention.
• Build and maintain CI/CD security gates: SAST/SCA, secret scanning, SBOM generation, dependency management, and container/IaC scanning — implemented as reusable pipeline components and enforced through automated policy.
• Encode security and compliance controls into infrastructure-as-code and policy-as-code so the easy path is the secure path.
• Help close the prototype‑to‑production gap: turn fast‑moving prototypes into production‑grade, secure