Staff DevSecOps Engineer - Remote/Hybrid Platform Security

Socket.dev; United States; On-site; USD 150,000 - 225,000; Full time

Benefits offered by this job

Health Insurance Coverage (medical, 3)

Life Insurance

Disability Insurance

401(k) with match

Employee Assistance Program

Paid Parental Bonding Benefit Program

Flexible PTO - 20–25 days

Job summary

Bankrate, part of Red Ventures, is seeking a DevSecOps Engineer to own our security posture across cloud and CI/CD pipelines. You will implement SOC 2 Type 2 controls, automate evidence generation, and embed security into the development lifecycle with policy-as-code.

You’ll build scalable security automation, run remediation workflows, and partner with governance teams to mature in-house security capabilities.

Qualifications

• 5+ years in security engineering, DevSecOps, or platform engineering with security focus.
• Hands-on cloud security experience on a major cloud provider.
• Strong infrastructure-as-code skills (Terraform) including policy-as-code.
• Proven CI/CD security experience integrated into developer workflows.
• Vulnerability management at scale with automation.
• Familiarity with SOC 2 or similar frameworks.

Responsibilities

• Own the engineering side of the compliance program (SOC 2 Type 2).
• Operate and improve the compliance automation platform and evidence pipelines.
• Productize compliance with policy-as-code and guardrails for faster audits.
• Own cloud security posture management and runtime security tooling.
• Triage findings, meet SLAs, and design automation to scale.
• Build auto-remediation workflows, including AI-assisted pipelines.
• Maintain CI/CD security gates and policy enforcement.

Skills

Security engineering

Cloud security

Terraform

CI/CD security

Vulnerability management

SOC 2

AI/LLM in security

Automation

Tools

SAST/SCA tooling

Secret scanning

IaC tooling

Job description

Bankrate, part of Red Ventures, is seeking a DevSecOps Engineer to own our security posture across cloud and CI/CD pipelines. You will implement SOC 2 Type 2 controls, automate evidence generation, and embed security into the development lifecycle with policy-as-code.

You’ll build scalable security automation, run remediation workflows, and partner with governance teams to mature in-house security capabilities.