Senior DevSecOps Engineer
Senior hands-on engineer on Exiger's Security team embedding security automation and secure engineering practices across the SDLC in a regulated cloud environment. Builds automated vulnerability/ticketing workflows, secure CI/CD pipelines, and policy-as-code using Python/Java, Kubernetes, cloud security tooling, and API integrations.
- Compensation
- Not disclosed
- Location
- McLean, Virginia, United States; Richmond, Virginia, United States
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- 8+ years in DevOps, platform engineering, cloud engineering, app/product security, DevSecOps, or cybersecurity engineering
- Hands-on experience designing, implementing, and operating DevSecOps capabilities in production
- Experience building security automation integrating security tools, ticketing platforms, CI/CD, and engineering workflows
- Software development/scripting with Python and/or Java, plus PowerShell, Bash, JavaScript, or TypeScript
- Ability to build maintainable, reusable, tested automation rather than one-time scripts
- Strong knowledge of REST APIs, webhooks, and systems integrations
- Experience automating ticket creation, assignment, escalation, and remediation tracking workflows
- Strong knowledge of CI/CD security, application security testing, vulnerability management, and software supply-chain security
- Experience securing cloud platforms, containers, Kubernetes, IaC, Linux, networking, identity, encryption, logging, and secrets management
- Knowledge of SAST, DAST, software composition analysis, secrets/container/IaC scanning and related DevSecOps controls
- Knowledge of threat modeling, OWASP guidance, web/API security, authentication, authorization, and secrets management
- Experience prioritizing vulnerabilities and findings by technical and business risk
- Strong communication skills with technical and non-technical stakeholders
- Bachelor's degree in computer science, cybersecurity, engineering, or related discipline, or equivalent practical experience
Nice to have
- Hands-on experience with CrowdStrike, Microsoft Sentinel, Aikido Security, Code42, and/or Qualys
- Experience integrating security platforms with Jira, ServiceNow, or similar ticketing/workflow systems
- Experience with SOAR platforms or equivalent automated security workflows
- Experience with cloud-native security technologies: Kubernetes, Docker, Terraform, Helm, cloud IAM
- Experience with policy-as-code: OPA, Rego, Kyverno, or similar
- Familiarity with SBOMs, artifact signing, dependency security, provenance, and supply-chain frameworks
- Experience supporting regulated environments/frameworks: FedRAMP, NIST, SOC 2, ISO 27001, or similar
- Experience developing security metrics, dashboards, and automated compliance evidence
Full description
Who We Are:
Exiger is the AI partner for supply chain and procurement automation. Its centralized platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management.
Senior DevSecOps Engineer
Location: Richmond, VA preferred
Position Summary
The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle.
As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction.
A key focus of this role is security automation. The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting.
The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and automation experience and is comfortable operating in regulated, cloud-based environments.
Responsibilities
-
Design, build, and maintain automated security workflows across the software development lifecycle and broader security environment.
-
Automate security processes such as vulnerability intake, ticket creation, assignment, enrichment, escalation, remediation tracking, exception handling, and reporting.
-
Integrate security platforms with ticketing, CI/CD, cloud, and engineering systems using APIs, webhooks, scripts, and workflow automation.
-
Embed automated application, dependency, secrets, infrastructure-as-code, container, and API security testing into CI/CD pipelines.
-
Define and implement risk-based release gates, remediation timelines, exception processes, and finding ownership.
-
Build reusable secure pipeline templates, hardened images, self-service security controls, and policy-as-code guardrails.