Senior DevSecOps Engineer & Cloud Security Architect

Clear Street; New York (NY); Hybrid; USD 175,000 - 210,000; Full time

Benefits offered by this job

Company equity

401k matching

Parental leave

Medical insurance

Dental insurance

Vision insurance

Lunch stipends

Fully stocked kitchens

Happy hours

Great location

Amazing views

Job summary

Clear Street is seeking an experienced Application Security Engineer to lead security across the product development lifecycle, from source code to cloud deployments. You will own security controls in CI/CD, remediate vulnerabilities with engineers, and guide threat modeling and incident response efforts.

The role emphasizes building secure infrastructure, scaling DevSecOps with automation and AI-based tooling, and collaborating with Infra to enforce policy-as-code.

Qualifications

• 7+ years in a DevSecOps, application security, or cloud security engineering role.
• Hands-on experience with CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, or similar).
• Proficiency with at least one major cloud provider (AWS, Azure, or GCP) and its native security services.
• Experience with SAST/SCA tools (e.g., Semgrep, Snyk, Checkmarx, Veracode) and interpreting findings.
• Working knowledge of container and Kubernetes security (image scanning, RBAC, network policies, admission control).
• Scripting skills in Python, Bash, or similar for automation and tooling.
• Familiarity with IaC tools (Terraform, CloudFormation, Pulumi) and policy frameworks (OPA/Rego, Checkov).
• Understanding of OWASP Top 10, CWE, and common vulnerability classes.
• Strong communication skills — able to explain security risk clearly to non-security audiences.

Responsibilities

• Own security controls within CI/CD pipelines (SAST, DAST, SCA, secrets detection) and maintain pipeline-as-code tooling.
• Work with engineers to identify and remediate vulnerabilities in application source code.
• Manage the vulnerability lifecycle: triage findings from scanners, prioritize by risk, track remediation, and report on trends.
• Lead cloud security efforts, work with engineering teams to enforce cloud security best practices (IAM, network controls, storage security, workload protection).
• Maintain and tune security tooling including SAST/DAST scanners, container security platforms, and dependency analysis tools.
• Build automation and AI based tools to scale Devsecops operations.
• Partner with Infra Engineering teams to define secure infrastructure-as-code (IaC) standards and enforce them via policy-as-code.
• Participate in threat modeling sessions and security design reviews for new features and services.
• Support incident response activities related to application and cloud security events.
• Contribute to security documentation, runbooks, and developer-facing guidance.

Skills

DevSecOps

Application Security

Cloud Security

CI/CD

Scripting

IaC

Security Design

Tools

GitHub Actions

GitLab CI

Jenkins

Semgrep

Snyk

Checkmarx

Veracode

Job description

Clear Street is seeking an experienced Application Security Engineer to lead security across the product development lifecycle, from source code to cloud deployments. You will own security controls in CI/CD, remediate vulnerabilities with engineers, and guide threat modeling and incident response efforts.

The role emphasizes building secure infrastructure, scaling DevSecOps with automation and AI-based tooling, and collaborating with Infra to enforce policy-as-code.