Senior DevSecOps Engineer

Description

The company helps small businesses handle HR so they can focus on running their business. The team is data-driven and keeps improving its product.

This role sits in the Platform group within Engineering. You would be one of the first dedicated DevSecOps engineers in an organization that supports more than 300 engineers.

You would work with the Developer Experience and SRE teams and partner closely with the Security organization to shape how secure software is built, including the use of AI to find and fix vulnerabilities before release.

Security finds and reports on risk, while Engineering fixes it. This role sits between the two, working with Digital Security on coverage and driving fixes through Engineering.

Responsibilities

• Build security checks into the GitHub Actions CI/CD pipelines, covering SAST, SCA, secrets detection, and container scanning, tuned to run quickly and flag only issues worth fixing.
• Add security defaults to golden path templates for Go, Rails, and Vue.js so new services start secure.
• Strengthen the software supply chain through dependency management, artifact signing, SBOM generation, and provenance tracking.
• Implement and tune Terraform scanning and Kubernetes policy enforcement to catch misconfigurations before they reach an environment.
• Coordinate remediation of vulnerabilities across Engineering, including code issues, infrastructure configuration changes, and patching.
• Build vulnerability management automation that sends findings to owning teams with context, removes duplicates, and tracks fixes without spreadsheets.
• Implement secrets management and drive the move away from long-lived credentials toward short-lived, federated identity.
• Work with Security on cloud posture across AWS, and make sure Platform telemetry gives Detection & Response what they need.
• Support Security's rollout of agentic penetration testing and build auto-remediation that fixes findings before they can be exploited.
• Explore and roll out AI-assisted security review of code changes, with guardrails that keep signal high and false positives low.
• Create documentation and developer education so teams understand and adopt the controls.
• Track time-to-remediate, scan coverage, secrets findings, and mean time to patch to show whether security is improving.
• Advocate for secure development practices and help define how secure software is engineered.

Requirements

• Believe that secure defaults work better than gates engineers route around. Build guardrails such as pipelines that catch vulnerabilities early, golden paths with security included, and automation that shows patch status on a dashboard.
• Be comfortable working in CI/CD pipelines, AWS accounts, and Kubernetes clusters.
• Read application code well enough to separate real injection risks from scanner noise, and prefer fixing the template that produced a bug over filing many tickets.
• Have 5+ years of professional experience in software engineering, infrastructure, or security engineering.
• Have 3+ years focused on application security, security automation, or DevSecOps practice.
• Have hands-on experience adding SAST, SCA, secrets detection, and container scanning to CI/CD pipelines. GitHub Actions experience is strongly preferred.
• Be proficient with AWS security services, including IAM, GuardDuty, Security Hub, and CloudTrail, and able to design least-privilege access.
• Have experience with Kubernetes and infrastructure-as-code, with Terraform preferred, including policy-as-code enforcement.
• Be proficient in at least one programming language. Go, Python, or Ruby is preferred. You build tooling rather than only configuring it.
• Have a record of reducing security friction for engineers, with examples of controls teams adopted willingly.
• Communicate clearly in writing and document as you build.
• Bring good judgement, resourcefulness, strong teamwork and communication, influence and leadership, and a commitment to continued learning.
• Align your behavior with the COGIS values: camaraderie, openness, grit, integrity, and simplicity.

Conditions

Reports to Platform Engineering, with a dotted line to Digital Security leadership.

The base wage is targeted at $188,000.00 to $242,000.00 per year for this position based in the New York City office.

Actual pay depends on factors such as skill set, level of relevant experience, and work location. Ranges for other locations may differ based on local labor costs.

Benefits

• Enjoy a welcoming, casual environment, wellness program offerings, and company retreats.
• Learn from leaders in the startup community.
• Review the company's Total Rewards philosophy for full details of perks and benefits.