Senior DevSecOps Engineer (Contract)

Stevens; United States; Remote; USD 150,000 - 190,000; Full time

Job summary

Stevens is seeking a Senior DevSecOps Engineer to join a client’s security and platform engineering team in a large enterprise environment. You’ll be embedded with the client’s team, defining security in the software development lifecycle and building automation that accelerates delivery.

Role includes hands-on pipeline work, tooling, and architecture beyond advisory work, with opportunity to drive reusable automation and secure CI/CD practices across cloud infrastructure.

Qualifications

• Eight or more years of relevant experience in application security, DevSecOps, or platform engineering.
• Strong hands-on capability in security tooling and pipelines.
• Experience with large enterprise security programs and governance.

Responsibilities

• Design, implement, and operate advanced SAST and SCA automation integrated into CI/CD pipelines.
• Build vulnerability management workflows with triage and ownership.
• Strengthen software supply chain security across dependencies and provenance.
• Develop CI/CD automation and GitHub-based security controls.
• Create infrastructure as code and reusable automation frameworks.
• Improve container security and image scanning practices.
• Evaluate AI-assisted security capabilities for developer productivity.
• Establish standards and reference implementations for teams.
• Communicate findings to engineers and leadership.
• Document configurations and decisions for maintainability.

Skills

8+ years experience

SAST & SCA tooling

Nexus Repository

Vulnerability management

SBOMs & provenance

GitHub Actions CI/CD

Jenkins to GitHub Actions migration

Terraform & IaC

Container security

AI-assisted security tooling

Scripting (Python/Bash/PowerShell)

Effective communication

Tools

SonarQube

Nexus IQ

Nexus Repository

Job description

About the team

Stevens builds software for clients through small delivery pods that bring engineers and delivery leadership together around a defined engagement. We also place experienced engineers directly with client teams when a client needs specific depth embedded in their own organization.

Our work connects technical decisions to practical outcomes. That means understanding how a client operates, navigating existing systems, and building solutions that people can use and maintain. We value engineers who contribute to both the implementation and the thinking behind it.

About the role

We're looking for a Senior DevSecOps Engineer to join a client's security and platform engineering team in a large enterprise environment. You'll be embedded with the client's team, working directly within their organization, on their systems and alongside their engineers, with Stevens supporting the engagement.

The role combines advisory and leadership responsibilities with hands-on technical work. You'll help define how security is built into the software development lifecycle, from static analysis and dependency scanning through CI/CD pipelines, infrastructure as code, and container security. You'll be expected to establish standards, validate approaches, and work through technical problems directly rather than only describing how they should be solved.

This is not an architecture-only or advisory-only position. When the team needs someone to prove out a pipeline integration, tune a scanning tool, or build a reusable automation framework, that someone is you.

The client's current work spans GitHub migrations and reusable workflows, a Jenkins-to-GitHub Actions transition, SonarQube and Nexus/Nexus IQ, container security, Terraform-based infrastructure as code, and broader automation across cloud and application delivery. You should be senior enough to contribute to this work quickly and help accelerate it.

In this role, you will

• Design, implement, and operate advanced SAST and SCA automation integrated into developer workflows and CI/CD pipelines.
• Build and refine vulnerability management and remediation workflows, including triage, prioritization, ownership, and tracking to closure.
• Strengthen software supply chain security across dependencies, build systems, artifact integrity, and provenance.
• Develop CI/CD and GitHub-based automation that enforces security controls without slowing delivery.
• Create infrastructure as code and reusable automation frameworks that other teams can adopt and maintain.
• Improve container and dependency security, including image scanning, base image governance, and runtime hardening.
• Evaluate and introduce AI-assisted security capabilities that improve developer productivity and strengthen security throughout the SDLC.
• Establish standards and reference implementations, then help engineering teams adopt them in practice.
• Communicate findings, tradeoffs, and recommendations clearly to engineers, security leadership, and nontechnical stakeholders.
• Document decisions, configurations, and operating context so the work can be maintained after the engagement.

You’ll bring

• Eight or more years of relevant experience in application security, DevSecOps, platform engineering, or a closely related discipline, with demonstrated hands-on technical capability.
• Deep experience with SAST and SCA tooling (SonarQube, Nexus IQ, or equivalents), including integration, tuning, and managing results at scale.
• Hands-on experience with Nexus Repository or similar artifact repositories, including dependency governance and policy enforcement.
• Practical experience with vulnerability management programs and remediation workflows in large organizations.
• Working knowledge of software supply chain security concepts and controls (SBOMs, artifact signing, provenance, dependency governance).
• Strong CI/CD experience with GitHub Actions, including reusable workflows and GitHub-based automation at scale.
• Experience migrating from Jenkins to GitHub Actions, or comparable CI/CD migration experience.
• Experience with Terraform and infrastructure as code, and building reusable automation others can consume.
• Solid understanding of container security, image scanning, and dependency hygiene.
• Interest in and exposure to AI-assisted security and developer tooling.
• Scripting and automation proficiency (Python, Bash, PowerShell, or similar).
• A track record of operating successfully in complex enterprise environments with multiple teams, legacy systems, and competing priorities.
• Clear communication and the judgment to balance security rigor with delivery realities.

How we work

In this engagement, you'll work within the client's team, tools, and processes while Stevens remains your point of contact for engagement support. We expect you to ask questions, contribute your perspective, and help the team make progress when the path is unclear.

Client trust matters. We build it through realistic commitments, visible progress, thoughtful handling of feedback, and early communication when something changes.

Where AI-assisted development tools are approved for use, you remain responsible for understanding and verifying the resulting work, protecting client information, and following the engagement's security and tool-use requirements.

Engagement and compensation

This is an independent contractor engagement supporting a Stevens client. We prefer to contract corp-to-corp through your own LLC or corporation, though we will consider 1099 arrangements for the right candidate. The engagement is open only to contractors who reside and perform their work in the United States throughout the engagement.

• Commitment: full-time.
• Engagement length: 6-9 months.

Payments are processed every two weeks through our contractor payroll platform. The contractor agreement will define the scope and engagement terms, including any insurance or documentation requirements. Onboarding will include access requirements and the payment schedule.

Interview process

We begin with a Stevens talent assessment: an introductory conversation on Zoom covering your experience, hands-on depth across the areas above, and engagement fit.

Next is a technical assessment. We'll provide the time limit, deadline, and permitted-tool guidelines before you begin.

Qualified candidates are then introduced to the client for technical interviews, where the client will evaluate technical depth, hands-on capability, communication skills, and overall fit for the engagement. The client intends to move quickly once the right candidate is identified.

Selected candidates will also be required to complete a criminal background screening and identity verification as part of the engagement process. We'll provide instructions and obtain any required authorization before initiating screening.