Sr. Security Engineer

istaridigital.ai; United States; Remote; USD 135,000 - 220,000; Full time

Benefits offered by this job

Bonuses

Equity

Benefits

Job summary

istaridigital.ai seeks a senior DevSecOps leader to own and evolve pipeline security tooling, automate secure feedback, and expand testing and incident response capabilities across development and deployment. You will translate compliance requirements into risk-based checks for government and regulated environments, guiding engineering and security teams with minimal friction.

You will map controls to NIST RMF, implement code analysis, SCA, secrets scanning, and container scanning in CI/CD, and

Qualifications

• 7+ years in DevSecOps, application security, or security engineering roles.
• 3+ years owning CI/CD security tooling.
• Experience mapping controls to NIST RMF/800-53; evidence prep.

Responsibilities

• Own and improve pipeline security tooling for code analysis, dependency risks, secrets detection, container scanning, and artifact signing.
• Assess tool coverage, address gaps, guide tool selection and roadmap.
• Map compliance and risk framework requirements to pipeline controls, thresholds, and evidence.
• Develop automated and manual penetration testing with fast feedback to engineering teams.
• Help build security operations and incident response processes with automation and human review.
• Use scripting and AI-assisted methods to improve security workflows, triage, or remediation quality.

Skills

DevSecOps

Application security

Security operations

Incident response

Security engineering

Scripting/Automation

Tools

GitHub

Argo CD

JFrog

Snyk

Job description

Role overview

Lead the security tooling and controls that assess software throughout development and deployment. You will translate compliance requirements into risk-based automated checks that give engineers useful feedback early, while helping expand security testing and incident response capabilities. The position supports regulated and security-sensitive systems, including government customer environments, and works closely with engineering and cybersecurity leaders.

Responsibilities

• Own and improve pipeline security tooling for code analysis, dependency risks, secrets detection, container scanning, and artifact signing.
• Assess tool coverage and effectiveness, address gaps, and guide tool selection, configuration, and the long-term security tooling roadmap.
• Map compliance and risk framework requirements to pipeline controls, thresholds, exceptions, and evidence for reviews or authorizations.
• Develop automated and manual penetration testing with fast feedback to engineering teams.
• Help build security operations and incident response processes with appropriate automation and human review.
• Use scripting and AI-assisted methods where they can improve security workflows, triage, or remediation quality.

Requirements

• At least seven years in DevSecOps, application security, security operations, incident response, or security engineering, including three years owning CI/CD security tooling.
• Hands-on experience configuring and enforcing code analysis, software composition analysis, secrets detection, and container scanning in production pipelines.
• Experience mapping security controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements and preparing assessment or authorization evidence.
• Demonstrated ability to evaluate and evolve security tools and influence engineering teams without direct authority.
• Scripting or automation experience in Python, Bash, or similar.
• Security+ or an equivalent DoD 8140 qualifying certification, or ability to obtain one within two months of hire; must be a U.S. citizen residing and working in the United States.

Nice to have

• Familiarity with GitHub, Argo CD, JFrog, Snyk, cloud and container environments, or government DevSecOps software factories.
• Experience supporting ATO efforts, including control assessments and POA&M management, or using software supply-chain controls such as SBOMs and policy as code.
• Experience applying AI or language models to security engineering, penetration testing, or advanced security certifications; an active clearance is desirable.

Benefits and work setup

• The listed salary range is $135,000–$220,000 annually. The role may also include bonuses, equity, and benefits; compensation varies with experience, qualifications, location, and business needs.