Senior DevSecOps Engineer: Cloud Security & Automation

Flexhire; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

TinyFish seeks a hands-on Senior DevSecOps Engineer to drive security across infrastructure and product engineering. You will own vulnerability management, automate security controls, and collaborate with engineering to remediate findings and close gaps.

This role focuses on translating policies, compliance requirements, and risk findings into actionable engineering work. You will partner with Infrastructure, Engineering, Product, and leadership to execute the security program.

Qualifications

• 5+ years of hands-on DevSecOps, cloud security, or security engineering experience.
• Experience building or operating a vulnerability-management program and remediation.
• Strong knowledge of AWS security, IAM, VPC, KMS, logging, and multi-account setups.
• Experience with infrastructure as code (Terraform preferred).
• Experience securing CI/CD pipelines and artifacts (GitHub Actions).
• Knowledge of SAST, DAST, software composition analysis, and container scanning.

Responsibilities

• Own the vulnerability-management lifecycle across cloud infra, apps, containers, CI/CD, and production services.
• Establish repeatable vulnerability-discovery, triage, remediation SLAs, and reporting processes.
• Drive closure of high-severity findings with owners and escalation when needed.
• Implement and maintain security controls across AWS (IAM, networking, encryption, key management, secrets).
• Integrate security into the SDLC with guardrails for SAST/DAST, dependency checks, and IaC scans.
• Review designs, perform threat modeling, and translate risks into engineering actions.
• Improve security across APIs, authentication, service-to-service communication, and data protection.
• Coordinate third-party pen tests and ensure findings are remediated and validated.
• Develop incident-response playbooks and participate in security incidents and tabletop exercises.
• Collaborate with Infra and Observability to improve security logging and detection workflows.
• Convert policies to automated checks and engineering requirements; support audits (SOC 2, ISO 27001).
• Create practical security guidance to help engineers ship secure systems with minimal friction.

Skills

DevSecOps

Cloud security

Application security

Security engineering

Vulnerability management

Scripting (Python/Bash)

Threat modeling

Communication skills

Tools

Terraform

GitHub Actions

SAST

DAST

IAM/KMS security

Job description

TinyFish seeks a hands-on Senior DevSecOps Engineer to drive security across infrastructure and product engineering. You will own vulnerability management, automate security controls, and collaborate with engineering to remediate findings and close gaps.

This role focuses on translating policies, compliance requirements, and risk findings into actionable engineering work. You will partner with Infrastructure, Engineering, Product, and leadership to execute the security program.