Senior DevSecOps Security Engineer

Highmark Health; Washington (NC); Hybrid; USD 103,000 - 165,000; Full time

Job summary

Highmark Health seeks a Senior Security Engineer to join the Enterprise Application Security team. You will embed security into the software development lifecycle, automate security gates, and guide engineers in adopting secure coding practices across a large distributed organization.

The role emphasizes hands-on engineering, vulnerability triage, and building scalable security-as-code policies to reduce risk pre-production.

Qualifications

• Bachelor's degree in CS/IS or closely related field.
• 7+ years in Information Security or IT with demonstrated security program delivery.
• Experience integrating security into DevOps/SDLC practices.

Responsibilities

• Lead teams to define requirements, deliverables, and timelines.
• Escalate issues and provide remediation recommendations to stakeholders.
• Conduct root-cause analyses to fix security problems in ISRM Infrastructure.
• Develop and deliver technical security training for engineers.
• Mentor junior staff in security practices and tooling.
• Implement, monitor, and maintain security systems and gates in pipelines.

Skills

Shift-left security

SAST/DAST tooling

CI/CD security

Security automation

GitLab/GitHub Actions

Container security (Docker/Kubernetes)

Secure SDLC

Threat modeling (STRIDE/PASTA)

Code review of security findings

AI security awareness

Vulnerability risk reduction

Security metrics & KPIs

Education

Bachelor's Degree in Computer Science/Information Systems or related field

Master's Degree in Computer Science or related field

Tools

GitLab Ultimate

JFrog Xray

CI/CD tooling

Job description

Highmark Health seeks a Senior Security Engineer to join the Enterprise Application Security team. You will embed security into the software development lifecycle, automate security gates, and guide engineers in adopting secure coding practices across a large distributed organization.

The role emphasizes hands-on engineering, vulnerability triage, and building scalable security-as-code policies to reduce risk pre-production.