Staff DevSecOps Engineer: Security Automation & Migration

CVS Health; New York (NY); Hybrid; USD 130,000 - 261,000; Full time

Job summary

CVS Health is seeking a Staff Engineer, DevSecOps Security Engineering, to lead security implementation, migration and automation across the Health 100 portfolio. You will translate security strategy into scalable engineering patterns, drive secure-by-default delivery, and enable secure testing and remediation across engineering teams.

You will own major security initiatives, shepherd open-source and third-party risk management, and collaborate with cross-functional teams to deliver measurable

Qualifications

• 7+ years of experience in DevSecOps, application security engineering, platform security or software engineering.
• Experience integrating SAST, SCA, secrets detection, container scanning, IaC scanning into CI/CD pipelines.
• Experience leading security implementations or tool migrations in large or complex engineering environments.

Responsibilities

• Lead security implementations and tool migrations across Health 100 portfolio.
• Design, plan and deliver DevSecOps implementations with migration and automation.
• Coordinate across teams to remove blockers and sustain adoption of security controls.
• Design and improve CI/CD security controls, including automated scanning workflows.
• Standardize tooling configurations and enable secure-by-default deployment patterns.
• Measure security outcomes and drive remediation within SLAs.

Skills

DevSecOps

Application security

Automation

CI/CD security

SAST

SCA

Docker

Kubernetes

IaC scanning

Cloud security

Education

Bachelor's degree in Computer Science or related field

Tools

Snyk

Checkmarx

Gitleaks

Job description

CVS Health is seeking a Staff Engineer, DevSecOps Security Engineering, to lead security implementation, migration and automation across the Health 100 portfolio. You will translate security strategy into scalable engineering patterns, drive secure-by-default delivery, and enable secure testing and remediation across engineering teams.

You will own major security initiatives, shepherd open-source and third-party risk management, and collaborate with cross-functional teams to deliver measurable