Senior Security Engineer

Core Responsibilities

Own and evolve the security toolchain

• Serve as the technical owner of our pipeline security tooling, including static application security testing (SAST), software composition analysis (SCA), secrets detection, container scanning, and artifact signing

• Assess tooling effectiveness and coverage, identify gaps, and recommend and lead improvements, consolidation, or replacement as needs evolve

• Develop automated and manual pen-testing capabilities with rapid feedback loops into the engineering process.

• Help mature the security operations and incident response capabilities of the company.

• Define the long-term roadmap for security tooling and processes in partnership with Cybersecurity and Engineering leadership

Tune controls to compliance requirements

• Translate NIST SP 800-53, NIST SP 800-171, and RMF control requirements into enforceable pipeline gates, thresholds, and policies

• Evolve and maintain risk-based pass/fail criteria that balance security assurance with delivery speed and minimize false positives

• Ensure tooling outputs produce assessor-ready evidence that supports authorizations, continuous monitoring, and audits

• Own the exception and manual-review process for findings that fail automated checks, so decisions are documented and traceable

Enforce integrity and consistency

• Ensure security results cannot be bypassed or tampered with, including enforcement of artifact signing, signature verification before deployment, commit signing, branch protection, and repository rulesets

• Automate the creation and maintenance of software bills of materials (SBOMs) and vulnerability exploitability exchange (VEX) data for delivered software

Drive shift-left adoption

• Move security checks to the earliest practical point (developer workstation, pre-commit, pull request, etc.)

• Partner with engineering teams to embed security into their workflows, supported by clear standards and guidance, so the secure path is the easy path

• Apply artificial intelligence (AI) tooling to accelerate vulnerability triage, remediation, and security automation, and evaluate emerging AI capabilities for the toolchain