Senior DevSecOps Engineer
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 6+ years
- Category
- Security
- Posted
Skills
Nice to have
- Experience with containerization technologies, such as Docker or Kubernetes
- Experience with repository managers, such as Artifactory
- Experience with cloud computing services, such as Azure, AWS, or GCP
- Experience with C++ and build systems, such as gmake, scons, or cmake
- Experience with DAST tools, such as Invicti
- Experience generating and managing SBOMs in standard formats, such as SPDX or CycloneDX
- Understanding of open-source license compliance
- Experience supporting application security reviews, threat modeling, or penetration test remediation
- Familiarity with Python scientific and engineering libraries
- Experience managing JavaScript/TypeScript dependencies with npm, including upgrades in Angular applications
Full description
The group you’ll be a part of
The Office of the CTO is where innovation takes center stage. We inspire our global technical community to take on grand challenges, understand emerging trends, identify the critical inflections, and drive our sustainability, Environment, Social, and Governance (ESG) practices that will define the next generation of semiconductors and continued impact.
The impact you’ll make
Within Semiverse® Solutions at Lam Research, we build innovative software products to solve semiconductor technology challenges. Our leading 3D modeling software is revolutionizing the way semiconductor chips are fabricated around the world. Enabled by our core intellectual property – an accelerated 3D voxel modeling and visualization engine – our software is highly successful and is quickly evolving as our business and customer base expand rapidly.
As a Senior DevSecOps Engineer, you will be part of the Engineering Operations team, owning the security health of our desktop software products, web applications, and development pipelines. You’ll upgrade third-party and open-source dependencies directly in our product code, run automated tests, and troubleshoot compatibility issues. You’ll maintain the security scanning built into our CI/CD pipelines, and you’ll work closely with Product Security Engineers and Application Security Engineers in our central InfoSec organization to guide our products through a Secure Software Development Lifecycle (SDLC). This is a senior-level position with opportunities for independently driving projects to completion as well as technical career growth.
What you’ll do
- Remediate vulnerabilities in third-party and open-source dependencies identified by SCA and SAST scans, opening and testing pull requests directly against product code
- Run automated test suites and troubleshoot build and compatibility issues caused by dependency upgrades, collaborating with developers when deeper product expertise is needed
- Reduce outstanding security exceptions by identifying upgrade paths, replacement components, or mitigations for vulnerable dependencies
- Maintain and improve SAST, SCA, and DAST scanning and its integration into CI/CD pipelines, including scan templates, quality gates, and policies
- Generate and maintain Software Bills of Materials (SBOMs) and support vulnerability tracking and handling for released products
- Serve as the primary point of contact between Engineering and InfoSec, coordinating risk assessments, architecture and infrastructure reviews, and security exception requests by gathering inputs from development teams and tracking reviews through to approval
- Partner with Application Security Engineers on DAST and penetration testing, helping developers interpret findings and track remediation