[Hiring] Senior DevSecOps Engineer @CCC Intelligent Solutions

Role Description

As a Senior DevSecOps Engineer, you will drive the integration of security best practices into software development and delivery. Working with development, operations, and cross-functional stakeholders, you will translate security requirements into practical controls within product workflows. You will help teams deliver secure, scalable, high-quality software, strengthen the security posture, support compliance with industry standards, and continuously improve security practices in alignment with business objectives.

Key Responsibilities:

• Conduct security assessments and code reviews to identify vulnerabilities in applications and services.
• Implement security controls within CI/CD pipelines and development practices, partnering with development and operations teams to integrate and maintain those controls throughout software delivery.
• Develop and maintain security tools, frameworks, and processes that support secure coding.
• Automate selected security testing tasks within development workflows and make the resulting findings actionable for engineering teams.
• Perform dynamic scanning, penetration testing, and vulnerability assessments on web, mobile, and cloud-based applications.
• Work with engineering teams to prioritize findings, guide remediation, and validate fixes.
• Provide training and guidance to development and operations teams on secure coding and operations principles.
• Contribute to security policies, procedures, and controls, and translate applicable requirements into implemented controls within DevSecOps workflows.
• Configure and maintain application-facing network security controls in collaboration with application and infrastructure teams, aligning protections with application access requirements.
• Apply working knowledge of Azure and AWS infrastructure, services, and security capabilities to implement security controls for cloud-based applications and their supporting environments.
• Stay informed about emerging security threats, technologies, and best practices, applying relevant insights as needed.
• Document systems, processes, and procedures to foster knowledge sharing and maintain compliance.

AI-enabled DevSecOps responsibilities:

• Evaluate and integrate AI-assisted tools into DevSecOps workflows to support security automation, code review, vulnerability analysis, and remediation, retaining human oversight of security decisions.
• Review and validate AI-generated code, scripts, configurations, and remediation recommendations using code review, automated testing, and security scanning before adoption or deployment.
• Establish and document responsible-use practices for AI-assisted engineering, including appropriate handling of sensitive code and data, controlled tool access, and clear review and approval expectations.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, Computer Engineering, or a related field, or equivalent practical experience in application security or DevSecOps.
• Minimum of 5+ years in a security-focused role, preferably involving application security/DevSecOps, with demonstrated ability to independently deliver security improvements in collaboration with development and operations teams.
• Demonstrated hands-on experience integrating security measures into CI/CD pipelines, including implementing and maintaining those integrations using DevOps tools and practices.
• Hands-on experience securing containerized environments using Docker and Kubernetes, with the ability to explain the security controls implemented and how they support secure deployment and operation.
• Proficiency in scripting languages such as PowerShell, Bash, or Python.
• Working knowledge of networking concepts (DNS, load balancers, VPNs, VPCs, and access control).
• Hands-on experience using AI-assisted development or security tools in engineering workflows, with the ability to explain the use case, personal contribution, validation approach, and results.
• Ability to critically assess AI-generated code, scripts, configurations, and security findings; identify incorrect assumptions or insecure recommendations; and validate outputs through testing and security analysis.
• Experience applying responsible-use practices for AI tools, including protecting sensitive code and data, limiting tool permissions, and maintaining human review of consequential changes.

Requirements

• Knowledge of Secure Coding Practices: Able to understand and apply secure coding principles.
• Familiarity with common vulnerabilities (e.g., OWASP Top Ten).
• Collaboration and communication: Ability to work with development and operations teams across the development lifecycle, explain security requirements clearly, and agree on practical approaches for integrating security into delivery workflows.
• Practical Application Security Knowledge: Experience with application security tooling and automation supportive of DevSecOps efforts.
• Experience in Incident Response: Monitoring and responding to security incidents; guiding remediation and mitigation strategies.

Benefits

• 401K Match
• Paid time off
• Annual Incentive Plan Performance Bonus
• Comprehensive health insurance
• Adoption Assistance
• Tuition Reimbursement
• Wellness Programs
• Stock Purchase Plan options
• Employee Resource Groups