Development Security Operations (DevSecOps) Engineer

Description

The company puts music, sports and live entertainment together, and its music division, AEG Presents, runs tours, concerts and music festivals worldwide. AEG Presents is based in Los Angeles and works with artists at every career stage.

This is a hands-on technical role building and running secure software development practices across the organization. You will work with development, operations and security teams to keep software delivery and environments in line with current best practices, keep operations efficient and keep security controls strong. You will help bring security into every stage of the software development lifecycle, help find and reduce security risks, and help improve security automation, monitoring and compliance.

Responsibilities

• Review code and work with developers to find security flaws and apply secure coding practices.
• Guide development teams on secure coding and on building security into their lifecycle.
• Partner with the DevOps team to secure infrastructure and make sure applications deploy and run securely.
• Work with cross-functional teams to set security requirements, standards and guidelines for software projects.
• Review and improve CI/CD pipelines in GitHub Actions, Azure DevOps, AWS CodePipeline and Jenkins.
• Use Orca Security, Sysdig, Codacy and Azure Log Analytics to monitor system logs and application code for vulnerabilities.
• Keep up with new security threats, vulnerabilities and best practices, and build them into development processes.
• Protect container images, build artifacts and other packages in the CI/CD pipeline. Scan them for vulnerabilities before deployment and store and distribute them through secure registries.
• Help run the security program: carry out risk assessments using frameworks such as the OWASP Top 10, develop a risk treatment plan, write security policies and objectives, maintain security reports, and help put security controls in place in each development group.
• Manage vendor relationships.
• Work with internal and external teams on audits, incident response and compliance.
• Define requirements and processes for disaster recovery (DR) and business continuity. Once they are approved, help run a DR test.

Requirements

• Bachelor's degree (4-year).
• 2 to 5 years of related work experience.
• Experience managing vendor relationships and running an implementation from start to finish.
• Experience leading a team or managing security professionals.
• Experience with a unified, real-time monitoring and analytics platform such as Azure Log Analytics, Google Cloud Operations (Stackdriver), AWS CloudWatch, Sentry, Splunk or Datadog.
• Experience in at least one programming language: JavaScript, Ruby, Python, PHP or C.
• Experience with AWS, Azure and/or Google Cloud Platform.
• Experience with a CI/CD tool such as GitHub Actions, CircleCI, Jenkins, Azure DevOps or AWS CodePipeline.
• Experience applying SDLC frameworks such as OWASP Top 10, NIST and similar.
• Experience setting up infrastructure and application alerts, alarms and notifications.
• Proven experience as a DevSecOps engineer, software security engineer, security engineer or in a similar role.
• Strong knowledge of secure software development lifecycle (SSDLC) practices and secure coding principles.
• Comfortable with Git version control.
• Familiarity with security standards and frameworks such as OWASP Top 10, NIST, ISO 27001 or CIS Benchmarks.
• Enjoy working closely with a collaborative team.
• Strong analytical, decision-making, interpersonal and conflict resolution skills.
• Clear verbal and written communication.
• Results-driven, and you follow through reliably.

Conditions

Full-time position with a salary range of $80,509 to $128,000.

This position is not eligible for a bonus under the current bonus plan requirements.

The employer does not offer work visa sponsorship for this position.

The company may change or modify the job description at any time, and may ask employees to perform duties outside their normal description.

The company hires the most qualified applicants and is an equal opportunity employer, not discriminating on the basis of any legally protected status.

Benefits

• Medical, dental and vision insurance.
• Paid holidays, vacation and sick time.
• Company-paid basic life insurance and optional voluntary life insurance.
• Parental leave.
• 401(k) plan with a current employer match of 3%.
• Flexible spending and health savings account options.
• Wellness offerings.