Senior DevSecOps Engineer - Vulnerability & CI/CD Security

Boosta; United States; Remote; USD 140,000 - 180,000; Full time

Benefits offered by this job

Courses & conferences

Flexible schedule

Remote work

Paid vacation

Medical insurance

Sick leave

Wellness support

Community support

Team events

Job summary

Boosta is seeking a Middle+/Senior DevSecOps Engineer to join its service team, delivering secure design, development, content, and IT infrastructure for the holding’s projects. The role emphasizes vulnerability management across code, containers, and IaC, with hands-on remediation and coordination with development teams.

You will maintain SAST/DAST/SCA and secret scanning in CI/CD, review logs, and tune WAF/Cloudflare rules, while collaborating with a global team to ensure security and

Qualifications

• Hands-on vulnerability management with scanners like Trivy, Snyk, SonarQube, Semgrep, ZAP, and Gitleaks.
• Practical remediation skills: patching dependencies, Dockerfile changes, Terraform/Helm, and code PRs (Python/JS).
• Bash and Python for automation
• Docker & Kubernetes, CI/CD pipelines (GitLab, GitHub Actions, Jenkins)
• Cloud and networking basics
• Strong communication skills

Responsibilities

• Launch, monitor, and analyze scanning results across code, dependencies, containers, and IaC.
• Triage findings by real risk and coordinate remediation.
• Remediate: update dependencies, patch, harden Docker/K8s/IaC; create PRs without developer involvement.
• Coordinate fixes with development teams and verify remediation via re-scans.
• Maintain SAST/DAST/SCA/Secret Scanning tools; process security alerts.
• Review logs, work with SIEM/Wazuh rules, elevate incidents to SOC.
• Tune WAF/Cloudflare rules per procedures.
• Communicate findings and assign tasks to developers.

Skills

Vulnerability management

SAST/DAST/SCA

Docker & Kubernetes

Terraform/Helm

Python/JavaScript

CI/CD pipelines

Cloud platforms

Communication skills

Trivy

Snyk

SonarQube

Semgrep

OWASP ZAP

Gitleaks

GitLab CI

GitHub Actions

Jenkins

Tools

Trivy

Snyk

SonarQube

Semgrep

OWASP ZAP

Gitleaks

GitLab CI

GitHub Actions

Jenkins

Job description

Boosta is seeking a Middle+/Senior DevSecOps Engineer to join its service team, delivering secure design, development, content, and IT infrastructure for the holding’s projects. The role emphasizes vulnerability management across code, containers, and IaC, with hands-on remediation and coordination with development teams.

You will maintain SAST/DAST/SCA and secret scanning in CI/CD, review logs, and tune WAF/Cloudflare rules, while collaborating with a global team to ensure security and