Lead DevSecOps Engineer

Description

The company has spent more than 20 years in sports and live entertainment, hosting over 160 million guests a year, promoting more than 10,000 shows and presenting more than 22,000 events worldwide. It runs over 300 venues, sports franchises, music brands, entertainment districts, a ticketing platform and global sponsorship programs.

This is a global Information Security role reporting to the Vice President of Information Security. The role sets technical direction for DevSecOps and the Secure Software Development Lifecycle (SSDLC), embedding security into how software is built from start to finish.

You will work with Engineering, DevOps, Platform Engineering, Infrastructure and GRC teams to set secure development standards, harden application and cloud security, secure CI/CD pipelines, and grow security automation and continuous compliance. You will act as a trusted subject matter expert, shape technology strategy and lead cross-functional security work across the company's global technology estate.

The team works with colleagues in North America and Europe, so some work may fall across several time zones.

Responsibilities

• Lead the build-out and ongoing improvement of the company's SSDLC program, working with Information Security and Engineering leaders to set enterprise-wide secure development standards.
• Push security-by-design and automated controls through the development lifecycle so that development, platform and DevOps teams adopt them consistently, and lead security discussions with Engineering, DevOps and Infrastructure to drive that adoption.
• Own the architecture, strategy and steady maturing of enterprise CI/CD security, setting secure-by-design standards for delivery pipelines, deployment platforms and development tooling.
• Define and enforce secure build and deployment processes, container image handling and third-party dependency controls. Expand automated security testing, validation and policy enforcement, and keep security controls built into pipelines to support continuous compliance.
• Lead the architecture, rollout and governance of enterprise application security tools, including standards for SAST, DAST and other AppSec tooling.
• Improve security visibility and monitoring across development environments, and configure and maintain alerts, notifications and monitoring.
• Lead enterprise application risk assessments and threat modeling. Write and maintain SDLC security requirements, procedures and supporting documents.
• Document and track compliance against ISO 27001, SOC 2, NIST and related frameworks.
• Carry out secure code reviews, work with development teams on vulnerability fixes, and manage vulnerability reporting, remediation tracking and disclosure.
• Lead remediation work across engineering and development teams.
• Act as lead security advisor to Engineering, DevOps, Platform, Infrastructure and GRC teams, giving practical guidance from design through deployment.
• Define and maintain secure development standards and best practices, and advise on application and development initiatives.
• Lead security audits and evidence collection for SDLC and application security controls, and take part in control testing, validation and compliance assessments.
• Work with stakeholders on investigations and incident response involving applications and development environments.

Requirements

• A 4-year bachelor's degree in Computer Science, Cybersecurity, Engineering, Information Systems or a related field. A master's degree or advanced certifications are preferred.
• 5+ years of experience in DevSecOps, application security, security engineering or a related cybersecurity role.
• Proven record of building security into the software lifecycle, including CI/CD pipelines and modern delivery platforms.
• Hands-on use of application security testing tools, including SAST, DAST, SCA and container security solutions.
• Experience with threat modeling, application risk assessment, vulnerability management and remediation tracking.
• Experience setting up monitoring, alerting and security controls across cloud, application and infrastructure environments.
• Strong grasp of SSDLC practices and secure coding principles.
• Familiarity with modern application frameworks, including Laravel and other enterprise web frameworks.
• Strong stakeholder management, with the ability to build partnerships and align security goals with business needs.
• Ability to work well with globally distributed teams and attend occasional meetings across multiple time zones.
• Ability to juggle several projects at once and adapt to shifting priorities in a fast-paced setting.
• Experience with JavaScript, Python, Ruby, PHP or C.
• Experience with CI/CD platforms such as GitHub Actions, Jenkins, CircleCI, Azure DevOps or similar.
• Knowledge of SAST, DAST, SCA and container scanning methodologies.
• Experience with OWASP Top 10, NIST Secure Software Development Framework (SSDF) and related frameworks.
• Experience configuring application and infrastructure monitoring, alerts and notifications.
• Familiarity with container technologies and cloud-native deployment models.
• Strong analytical, troubleshooting and problem-solving skills.
• Excellent verbal and written communication skills.
• Ability to work effectively in a highly collaborative global team.
• Self-motivated, with strong ownership, accountability and attention to detail.
• Relevant certifications such as CISSP, CSSLP, GIAC Web Application Penetration Tester (GWAPT), GIAC Cloud Security Automation (GCSA), AWS Security Specialty, Microsoft Azure Security Engineer Associate, Certified Kubernetes Security Specialist (CKS), or equivalent.

Conditions

The pay scale shown applies to the LA Metro area. Pay may vary by geographic region.

This role is eligible for a bonus under the current bonus plan requirements.

The company does not offer work visa sponsorship for this position.

The company may change or modify the job description at any time, orally or in writing, and may require duties outside the normal description.

The company hires the most qualified applicants and is an equal opportunity employer, not discriminating on the basis of race, color, marital status, disability, religion, age, sex, sexual orientation, national origin, genetic information, veteran status or any other legally protected status.

Benefits

• Comprehensive benefits: medical, dental and vision insurance, paid holidays, vacation and sick time, company-paid basic life insurance, voluntary life insurance, parental leave, flexible spending and health savings account options, and wellness offerings.
• 401k plan with a current employer match of 3%.