istaridigital.ai - Sr. Security Engineer
Requirements
• 7+ years in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years owning security tooling in continuous integration and continuous delivery (CI/CD) pipelines • Deep hands-on experience configuring, tuning, and enforcing SAST, SCA, secrets detection, and container scanning tools in production pipelines, including risk-based gates, vulnerability thresholds, and exception processes • Demonstrated experience mapping security tooling and pipeline controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements, and producing evidence for assessments or authorizations • Track record of evaluating, selecting, or evolving security tooling, and influencing engineering teams without direct authority • Scripting or automation experience in Python, Bash, or similar • Security+ or equivalent Department of Defense (DoD) 8140 qualifying certification, or ability to obtain within 2 months of hire • U.S. citizen residing and working in the U.S. • Familiarity with tools such as GitHub, Argo CD, JFrog, and Snyk • Experience in DoD software factory or Government DevSecOps environments (for example, Platform One, Iron Bank, or Big Bang) • Experience supporting Authorization to Operate (ATO) efforts, including control assessment and Plan of Action and Milestones (POA&M) management • Experience with software supply chain integrity and policy-as-code practices, such as artifact signing, signature verification, SBOMs, Open Policy Agent (OPA), or Kyverno • Experience applying AI and large language model (LLM) tools to security engineering, such as AI-assisted triage, code review, or remediation • Experience with penetration testing tools, processes, strategies. • Familiarity with the cloud and container environments where pipelines run and are deployed (for example, Github, Docker, Kubernetes, and AWS) • Advanced certifications such as CISSP, SecurityX (CASP+), or GIAC (GSSP, GCSA, or similar) • Active security clearance (Top Secret highly desired)
Responsibilities
• Own and evolve the security toolchain • Serve as the technical owner of our pipeline security tooling, including static application security testing (SAST), software composition analysis (SCA), secrets detection, container scanning, and artifact signing • Assess tooling effectiveness and coverage, identify gaps, and recommend and lead improvements, consolidation, or replacement as needs evolve • Develop automated and manual pen-testing capabilities with rapid feedback loops into the engineering process. • Help mature the security operations and incident response capabilities of the company. • Define the long-term roadmap for security tooling and processes in partnership with Cybersecurity and Engineering leadership • Tune controls to compliance requirements • Translate National Institute of Standards and Technology (NIST) SP 800-53, NIST SP 800-171, and RMF control requirements into enforceable pipeline gates, thresholds, and policies • Evolve and maintain risk-based pass/fail criteria that balance security assurance with delivery speed and minimize false positives • Ensure tooling outputs produce assessor-ready evidence that supports authorizations, continuous monitoring, and audits • Own the exception and manual-review process for findings that fail automated checks, so decisions are documented and traceable • Enforce integrity and consistency • Ensure security results cannot be bypassed or tampered with, including enforcement of artifact signing, signature verification before deployment, commit signing, branch protection, and repository rulesets • Automate the creation and maintenance of software bills of materials (SBOMs) and vulnerability exploitability exchange (VEX) data for delivered software • Drive shift-left adoption • Move security checks to the earliest practical point (developer workstation, pre-commit, pull request, etc.) • Partner with engineering teams to embed security into their workflows, supported by clear standards and guidance, so the secure path is the easy path
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT