Senior DevSecOps Engineer

About the role

Exiger, an AI partner for supply chain and procurement automation, is hiring a Senior DevSecOps Engineer. The role is a hands-on technical leader who embeds scalable security controls, automation and secure engineering practices throughout the software development lifecycle. It sits within the Security team and works closely with Engineering, Cloud, Platform, IT and Compliance teams to automate security processes and give timely security feedback. The location is Richmond, VA preferred, and the position is listed as hybrid.

Key responsibilities

• Design, build and maintain automated security workflows across the software development lifecycle, including vulnerability intake, ticket creation, assignment, enrichment, escalation, remediation tracking and reporting.
• Integrate security platforms with ticketing, CI/CD, cloud and engineering systems via APIs, webhooks, scripts and workflow automation.
• Embed application, dependency, secrets, infrastructure-as-code, container and API security testing into CI/CD pipelines.
• Define risk-based release gates, remediation timelines, exception processes and finding ownership.
• Build reusable secure pipeline templates, hardened images, self-service security controls and policy-as-code guardrails.
• Strengthen security across cloud infrastructure, containers, Kubernetes, identity, secrets management, networking and deployment.
• Triage vulnerabilities and findings by severity, exploitability, exposure, asset criticality and business impact, and route them to the right owners.
• Secure source code, third-party dependencies, build systems, artifacts, container images and the software supply chain.
• Support application security reviews, threat modeling, security architecture reviews, monitoring and incident response.
• Translate regulatory and compliance requirements into technical controls and automated audit evidence.
• Partner with Engineering teams to remediate issues and promote secure development, evaluate emerging security technologies, and develop metrics and dashboards.
• Mentor engineers on DevSecOps and secure engineering practices.

Required profile

• Eight or more years of experience in DevOps, platform engineering, cloud engineering, application security, product security, DevSecOps or cybersecurity engineering.
• Significant hands-on experience designing, implementing and operating DevSecOps in production environments.
• Demonstrated experience building security automation and integrating security tools with ticketing platforms, CI/CD systems and engineering workflows.
• Bachelor's degree in computer science, cybersecurity, engineering or a related discipline, or equivalent practical experience.

Required skills

• Strong software development or scripting experience with Python and/or Java, plus PowerShell, Bash, JavaScript or TypeScript.
• REST APIs, webhooks and systems integration.
• CI/CD security, application security testing, vulnerability management and software supply-chain security.
• Cloud platforms, Kubernetes, infrastructure as code, Linux, networking, identity, encryption, logging and secrets management.
• SAST, DAST, software composition analysis, secrets scanning, container scanning and IaC scanning.
• Threat modeling, OWASP guidance, web and API security, authentication and authorization.
• Preferred: CrowdStrike, Microsoft Sentinel, Aikido Security, Code42, Qualys, SOAR platforms, Terraform, Helm, OPA, Rego, Kyverno, SBOMs, and regulated frameworks such as FedRAMP, NIST, SOC 2 and ISO 27001.