Senior DevSecOps Engineer - Cloud Security Lead (Remote)

S27a; Los Altos, Northern (CA, KY); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Remote work environment

Async-friendly

Competitive compensation

Job summary

TinyFish is seeking a hands-on Senior DevSecOps Engineer to drive the security program across infrastructure and product engineering. You will own the day-to-day vulnerability-management process, automate controls, and work with engineering to remediate findings and close gaps.

This individual-contributor role partners with Infrastructure, Engineering, Product, and leadership. Expect a bias for execution and collaboration across teams to implement pragmatic security measures.

Qualifications

• 5+ years of hands-on DevSecOps, cloud security, or related role.
• Experience building or operating vulnerability-management programs.
• Strong knowledge of AWS security including IAM, VPC, KMS, logging.

Responsibilities

• Own the vulnerability-management lifecycle across cloud, code, containers, CI/CD and prod services.
• Establish repeatable processes for discovery, triage, remediation SLAs, and reporting.
• Drive critical findings through remediation with owners and leadership escalation.
• Implement and maintain security controls across AWS (IAM, networking, encryption, logging).
• Integrate security into SDLC with SAST, DAST, dependency scanning, container scanning, and IaC checks.
• Review designs, perform threat modeling, and provide engineering recommendations.
• Improve security across APIs, authentication, service-to-service, and data handling.
• Coordinate third-party penetration tests and track remediation.
• Develop incident-response playbooks and participate in security incidents.
• Collaborate with Infra and Observability to improve logging and threat detection.
• Translate policies into automated checks and engineering work.
• Support SOC 2, ISO 27001, and other compliance initiatives.

Skills

DevSecOps

Cloud security

Application security

Security engineering

Vulnerability management

AWS security

Terraform

GitHub Actions

SAST

DAST

Threat modeling

Incident response

SOC 2 / ISO 27001

Python

Bash

Tools

Terraform

GitHub Actions

SAST

DAST

Software Composition Analysis

Secret detection

Container scanning

IaC scanning

Job description

TinyFish is seeking a hands-on Senior DevSecOps Engineer to drive the security program across infrastructure and product engineering. You will own the day-to-day vulnerability-management process, automate controls, and work with engineering to remediate findings and close gaps.

This individual-contributor role partners with Infrastructure, Engineering, Product, and leadership. Expect a bias for execution and collaboration across teams to implement pragmatic security measures.