Software Engineer 3: DevSecOps Security (Hybrid)

Commission Junction LLC; Agoura Hills (CA); Hybrid; USD 89,000 - 136,000; Full time

Benefits offered by this job

Hybrid work arrangements

Flexible time off

Paid holidays

Employee referral program

401k benefits

Medical, dental, vision

Job summary

CJ (Commission Junction) is seeking a Software Engineer 3 focused on security within Engineering Experience to advance DevSecOps practices. You will triage vulnerabilities, fix issues, and partner with GSO, auditors, and clients to deliver actionable guidance.

Hybrid role requiring 3 days in the office. You’ll work with Wiz, Veracode, AWS and Kubernetes, turning findings into secure, scalable solutions and shaping CJ's security posture across engineering teams.

Qualifications

• 3+ years of software or infrastructure engineering with hands-on security work.
• Bachelor's degree or equivalent experience.
• Able to read code and infrastructure config, not just scanner output.
• Understand common vulnerability classes and exploitability/impact.
• Ability to discuss threats credibly with teams operating AWS/Kubernetes.

Responsibilities

• Triage and respond to vulnerabilities identified through tools and tests.
• Analyze infrastructure and code to assess real risk beyond scanner results.
• Manage vulnerability queue from intake to remediation.
• Collaborate with engineers to articulate true threat behind findings.
• Remediate vulnerabilities directly when feasible or coordinate fixes.
• Integrate SAST/DAST into CI/CD pipelines.
• Contribute to security standards and coach teams on best practices.
• Verify AI-generated fixes against real code and runtime context.

Skills

3+ years of software/infra engineering

Code reading ability

AWS/Kubernetes fluency

Security experience

Education

Bachelor's degree or equivalent

Tools

Veracode

Wiz

Jira

GitLab CI/CD

Terraform

Kubernetes

Job description

CJ (Commission Junction) is seeking a Software Engineer 3 focused on security within Engineering Experience to advance DevSecOps practices. You will triage vulnerabilities, fix issues, and partner with GSO, auditors, and clients to deliver actionable guidance.

Hybrid role requiring 3 days in the office. You’ll work with Wiz, Veracode, AWS and Kubernetes, turning findings into secure, scalable solutions and shaping CJ's security posture across engineering teams.